theory Arch_R

lemma arch_decodeInvocation_wf[wp]:
  notes ensureSafeMapping_inv[wp del]
  shows "\<lbrace>invs' and valid_cap' (ArchObjectCap arch_cap) and
    cte_wp_at' ((=) (ArchObjectCap arch_cap) o cteCap) slot and
    (\<lambda>s. \<forall>x \<in> set excaps. cte_wp_at' ((=) (fst x) o cteCap) (snd x) s) and
    sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace>
   Arch.decodeInvocation label args cap_index slot arch_cap excaps
   \<lbrace>valid_arch_inv'\<rbrace>,-" apply (cases arch_cap) apply (simp add: decodeARMMMUInvocation_def ARM_H.decodeInvocation_def
                       Let_def split_def isCap_simps
                 cong: if_cong split del: if_split) apply (rule hoare_pre) apply ((wp whenE_throwError_wp getASID_wp
               | wpc | simp add: valid_arch_inv'_def valid_apinv'_def)+)[1] apply (clarsimp simp: word_neq_0_conv valid_cap'_def valid_arch_inv'_def valid_apinv'_def) apply (rule conjI) apply (erule cte_wp_at_weakenE') apply (simp, drule_tac t="cteCap c" in sym, simp) apply (subst (asm) conj_assoc [symmetric]) apply (subst (asm) assocs_empty_dom_comp [symmetric]) apply (drule dom_hd_assocsD) apply (simp add: capAligned_def) apply (elim conjE) apply (subst field_simps, erule is_aligned_add_less_t2n) apply assumption apply (simp add: asid_low_bits_def asid_bits_def) apply assumption
     \<comment> \<open>ASIDControlCap\<close> apply (simp add: decodeARMMMUInvocation_def ARM_H.decodeInvocation_def
                      Let_def split_def isCap_simps
                cong: if_cong invocation_label.case_cong arch_invocation_label.case_cong
                      list.case_cong prod.case_cong
           split del: if_split) apply (rule hoare_pre) apply ((wp whenE_throwError_wp ensureEmptySlot_stronger
              | wpc
              | simp add: valid_arch_inv'_def valid_aci'_def is_aligned_shiftl_self
               split del: if_split)+)[1] apply (rule_tac Q'=
                      "\<lambda>rv. K (fst (hd [p\<leftarrow>assocs asidTable . fst p \<le> 2 ^ asid_high_bits - 1 \<and> snd p = None])
                               << asid_low_bits \<le> 2 ^ asid_bits - 1) and
                            real_cte_at' rv and
                            ex_cte_cap_to' rv and
                            cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = (UntypedCap False frame pageBits idx))
                                       (snd (excaps!0)) and
                            sch_act_simple and
                            (\<lambda>s. descendants_of' (snd (excaps!0)) (ctes_of s) = {}) "
                            in hoare_post_imp_R) apply (simp add: lookupTargetSlot_def) apply wp apply (clarsimp simp: cte_wp_at_ctes_of) apply (simp split del: if_split) apply (wp ensureNoChildren_sp whenE_throwError_wp|wpc)+ apply clarsimp apply (rule conjI) apply (clarsimp simp: null_def neq_Nil_conv) apply (drule filter_eq_ConsD) apply clarsimp apply (rule shiftl_less_t2n) apply (simp add: asid_bits_def asid_low_bits_def asid_high_bits_def) apply unat_arith apply (simp add: asid_bits_def) apply clarsimp apply (rule conjI, fastforce) apply (clarsimp simp: cte_wp_at_ctes_of objBits_simps archObjSize_def) apply (rule conjI) apply (case_tac cteb; clarsimp) apply (drule ctes_of_valid_cap', fastforce) apply assumption apply (simp add: ex_cte_cap_to'_def cte_wp_at_ctes_of) apply (drule_tac t="cteCap ctea" in sym, simp) apply (drule_tac t="cteCap cte" in sym, clarsimp) apply (rule_tac x=ba in exI) apply simp
    \<comment> \<open>PageCap\<close> apply (simp add: decodeARMMMUInvocation_def ARM_H.decodeInvocation_def
                       Let_def split_def isCap_simps
                cong: if_cong split del: if_split) apply (cases "invocation_type label = ArchInvocationLabel ARMPageMap") apply (rename_tac word vmrights vmpage_size option) apply (simp add: split_def split del: if_split
                cong: list.case_cong prod.case_cong) apply (rule hoare_pre) apply (wpsimp simp: valid_arch_inv'_def valid_page_inv'_def) apply (rule hoare_vcg_conj_lift_R,(wp ensureSafeMapping_inv)[1])+ apply (wpsimp wp: whenE_throwError_wp checkVP_wpR hoare_vcg_const_imp_lift_R
                              hoare_drop_impE_R ensureSafeMapping_valid_slots_duplicated'
                              createMappingEntries_valid_pde_slots' findPDForASID_page_directory_at'
                        simp: valid_arch_inv'_def valid_page_inv'_def)+ apply (clarsimp simp: neq_Nil_conv invs_valid_objs' linorder_not_le
                           cte_wp_at_ctes_of) apply (drule ctes_of_valid', fastforce)+ apply (case_tac option; clarsimp, drule_tac t="cteCap cte" in sym, simp) apply (clarsimp simp: valid_cap'_def ptBits_def pageBits_def
                            is_arch_update'_def isCap_simps capAligned_def vmsz_aligned'_def
                      cong: conj_cong) apply (rule conjI) apply (erule is_aligned_addrFromPPtr_n, case_tac vmpage_size, simp_all)[1] apply (simp add: vmsz_aligned_def) apply (rule conjI) apply (erule order_le_less_trans[rotated]) apply (erule is_aligned_no_overflow'[simplified field_simps]) apply (clarsimp simp: page_directory_at'_def pdBits_eq lookup_pd_slot_eq)+ apply (clarsimp simp: valid_cap'_def ptBits_def pageBits_def
                           is_arch_update'_def isCap_simps capAligned_def vmsz_aligned'_def
                     cong: conj_cong) apply (rule conjI) apply (erule is_aligned_addrFromPPtr_n, case_tac vmpage_size, simp_all)[1] apply (simp add: vmsz_aligned_def pd_bits) apply (clarsimp simp: page_directory_at'_def lookup_pd_slot_eq[simplified pd_bits]) apply (cases "invocation_type label = ArchInvocationLabel ARMPageUnmap") apply (simp split del: if_split) apply (rule hoare_pre, wp) apply (clarsimp simp: valid_arch_inv'_def valid_page_inv'_def) apply (thin_tac "Ball S P" for S P) apply (erule cte_wp_at_weakenE') apply (clarsimp simp: is_arch_update'_def isCap_simps) apply (cases "ARM_H.isPageFlushLabel (invocation_type label)") apply (clarsimp simp: ARM_H.isPageFlushLabel_def
                    split: invocation_label.splits arch_invocation_label.splits) apply (rule arch_decodeARMPageFlush_wf,
               clarsimp simp: ARM_H.isPageFlushLabel_def)+ apply (cases "invocation_type label = ArchInvocationLabel ARMPageGetAddress") apply (simp split del: if_split) apply (rule hoare_pre, wp) apply (clarsimp simp: valid_arch_inv'_def valid_page_inv'_def) apply (simp add: ARM_H.isPageFlushLabel_def throwError_R'
              split: invocation_label.split_asm arch_invocation_label.split_asm)
   \<comment> \<open>PageTableCap\<close> apply (simp add: decodeARMMMUInvocation_def ARM_H.decodeInvocation_def
                    Let_def split_def isCap_simps vs_entry_align_def
              cong: if_cong list.case_cong invocation_label.case_cong
                    arch_invocation_label.case_cong prod.case_cong
         split del: if_split) apply (rename_tac word option) apply (rule hoare_pre) apply ((wp whenE_throwError_wp isFinalCapability_inv getPDE_wp
            | wpc | simp add: valid_arch_inv'_def valid_pti'_def unlessE_whenE
            | rule_tac x="fst p" in hoare_imp_eq_substR)+) apply (rule_tac Q'=
"\<lambda>b c. ko_at' ARM_H.pde.InvalidPDE (b + (hd args >> 20 << 2)) c \<longrightarrow>
         cte_wp_at'
          (is_arch_update'
            (capability.ArchObjectCap
              (arch_capability.PageTableCap word (Some (snd p, hd args >> 20 << 20)))))
          slot c \<and>
         c \<turnstile>' capability.ArchObjectCap
                (arch_capability.PageTableCap word (Some (snd p, hd args >> 20 << 20))) \<and>
         is_aligned (addrFromPPtr word) ptBits \<and>
         valid_pde_mapping_offset' (b + (hd args >> 20 << 2) && mask pdBits)
        " in hoare_post_imp_R) apply ((wp whenE_throwError_wp isFinalCapability_inv getPDE_wp
                           | wpc | simp add: valid_arch_inv'_def valid_pti'_def unlessE_whenE
                           | rule_tac x="fst p" in hoare_imp_eq_substR
                           | rule hoare_drop_impE_R)+) apply (clarsimp simp: ko_wp_at'_def obj_at'_real_def) apply (clarsimp simp: projectKO_opt_pde vs_entry_align_def
                                        pageBits_def ptBits_def pdeBits_def pteBits_def
                                 split: Structures_H.kernel_object.splits arch_kernel_object.splits) apply ((wp whenE_throwError_wp isFinalCapability_inv
                         | wpc | simp add: valid_arch_inv'_def valid_pti'_def if_apply_def2
                         | rule hoare_drop_imp)+)[15] apply (clarsimp simp: linorder_not_le isCap_simps cte_wp_at_ctes_of) apply (frule eq_arch_update') apply (case_tac option; clarsimp) apply (drule_tac t="cteCap ctea" in sym, simp) apply (clarsimp simp: is_arch_update'_def isCap_simps valid_cap'_def capAligned_def) apply (thin_tac "Ball S P" for S P)+ apply (drule ctes_of_valid', fastforce)+ apply (clarsimp simp: valid_cap'_def ptBits_def is_aligned_addrFromPPtr_n invs_valid_objs'
                         and_not_mask[symmetric] pteBits_def) apply (erule order_le_less_trans[rotated]) apply (rule word_and_le2) apply (simp add: valid_cap'_def capAligned_def) apply (simp add: decodeARMMMUInvocation_def ARM_H.decodeInvocation_def isCap_simps Let_def) apply (cases "ARM_H.isPDFlushLabel (invocation_type label)"; simp) apply (cases args; wpsimp simp: valid_arch_inv'_def) apply wp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>x11 x12. arch_cap = arch_capability.ASIDPoolCap x11 x12 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 2. arch_cap = arch_capability.ASIDControlCap \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>x11 x12. arch_cap = arch_capability.ASIDPoolCap x11 x12 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMASIDPoolAssign \<Rightarrow> case snd (invocation_type label, excaps) of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None), pdCapSlot) # x \<Rightarrow> doE asidTable <- withoutFailure $ gets (armKSASIDTable \<circ> ksArchState);
base <- returnOk (capASIDBase (arch_capability.ASIDPoolCap x11 x12));
poolPtr <- returnOk (asidTable (asidHighBitsOf base));
whenE (isNothing poolPtr) $ throw $ Fault_H.syscall_error.FailedLookup False Fault_H.lookup_failure.InvalidRoot;
p <- liftME the $ returnOk poolPtr;
whenE (p \<noteq> capASIDPool (arch_capability.ASIDPoolCap x11 x12)) $ throw $ Fault_H.syscall_error.InvalidCapability 0;
pool <- liftME (inv asidpool.ASIDPool) $ withoutFailure $ getObject $ p;
free <- returnOk (filter (\<lambda>(x, y). x \<le> HaskellLib_H.bit asidLowBits - 1 \<and> x + base \<noteq> 0 \<and> isNothing y) $ assocs pool);
whenE (null free) $ throw Fault_H.syscall_error.DeleteFirst;
asid <- returnOk (fst $ head free);
returnOk $ invocation.InvokeASIDPool $ asidpool_invocation.Assign (asid + base) (capASIDPool (arch_capability.ASIDPoolCap x11 x12)) pdCapSlot
odE | (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb (Some a)), pdCapSlot) # x \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | (capability.ArchObjectCap _, pdCapSlot) # x \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | (_, pdCapSlot) # x \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 2. arch_cap = arch_capability.ASIDControlCap \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>x11 x12. arch_cap = arch_capability.ASIDPoolCap x11 x12 \<Longrightarrow> \<lbrace>?P'16 x11 x12\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMASIDPoolAssign \<Rightarrow> case snd (invocation_type label, excaps) of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None), pdCapSlot) # x \<Rightarrow> doE asidTable <- withoutFailure $ gets (armKSASIDTable \<circ> ksArchState);
base <- returnOk (capASIDBase (arch_capability.ASIDPoolCap x11 x12));
poolPtr <- returnOk (asidTable (asidHighBitsOf base));
whenE (isNothing poolPtr) $ throw $ Fault_H.syscall_error.FailedLookup False Fault_H.lookup_failure.InvalidRoot;
p <- liftME the $ returnOk poolPtr;
whenE (p \<noteq> capASIDPool (arch_capability.ASIDPoolCap x11 x12)) $ throw $ Fault_H.syscall_error.InvalidCapability 0;
pool <- liftME (inv asidpool.ASIDPool) $ withoutFailure $ getObject $ p;
free <- returnOk (filter (\<lambda>(x, y). x \<le> HaskellLib_H.bit asidLowBits - 1 \<and> x + base \<noteq> 0 \<and> isNothing y) $ assocs pool);
whenE (null free) $ throw Fault_H.syscall_error.DeleteFirst;
asid <- returnOk (fst $ head free);
returnOk $ invocation.InvokeASIDPool $ asidpool_invocation.Assign (asid + base) (capASIDPool (arch_capability.ASIDPoolCap x11 x12)) pdCapSlot
odE | (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb (Some a)), pdCapSlot) # x \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | (capability.ArchObjectCap _, pdCapSlot) # x \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | (_, pdCapSlot) # x \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x11 x12 s. \<lbrakk>arch_cap = arch_capability.ASIDPoolCap x11 x12; (invs' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> ?P'16 x11 x12 s
 3. arch_cap = arch_capability.ASIDControlCap \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 6. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>x11 x12 s. \<lbrakk>arch_cap = arch_capability.ASIDPoolCap x11 x12; (invs' and valid_cap' (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.ASIDPoolCap x11 x12)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (\<forall>x. invocation_type label = GenInvocationLabel x \<longrightarrow> True) \<and> (\<forall>x. invocation_type label = ArchInvocationLabel x \<longrightarrow> (x = ARMPDClean_Data \<longrightarrow> True) \<and> (x = ARMPDInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPDCleanInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPDUnify_Instruction \<longrightarrow> True) \<and> (x = ARMPageTableMap \<longrightarrow> True) \<and> (x = ARMPageTableUnmap \<longrightarrow> True) \<and> (x = ARMPageMap \<longrightarrow> True) \<and> (x = ARMPageUnmap \<longrightarrow> True) \<and> (x = ARMPageClean_Data \<longrightarrow> True) \<and> (x = ARMPageInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPageCleanInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPageUnify_Instruction \<longrightarrow> True) \<and> (x = ARMPageGetAddress \<longrightarrow> True) \<and> (x = ARMASIDControlMakePool \<longrightarrow> True) \<and> (x = ARMASIDPoolAssign \<longrightarrow> (snd (invocation_type label, excaps) = [] \<longrightarrow> True) \<and> (\<forall>x xa. snd (invocation_type label, excaps) = x # xa \<longrightarrow> (\<forall>xa xb. x = (xa, xb) \<longrightarrow> (\<forall>x. xa = capability.ThreadCap x \<longrightarrow> True) \<and> (xa = capability.NullCap \<longrightarrow> True) \<and> (\<forall>x xb xc xd. xa = capability.NotificationCap x xb xc xd \<longrightarrow> True) \<and> (\<forall>x. xa = capability.IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xb xc xd xe xf. xa = capability.EndpointCap x xb xc xd xe xf \<longrightarrow> True) \<and> (xa = capability.DomainCap \<longrightarrow> True) \<and> (\<forall>x xb xc. xa = capability.Zombie x xb xc \<longrightarrow> True) \<and> (\<forall>x. xa = capability.ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = arch_capability.ASIDPoolCap xa xb \<longrightarrow> True) \<and> (x = arch_capability.ASIDControlCap \<longrightarrow> True) \<and> (\<forall>xa xb xc xd xe. x = arch_capability.PageCap xa xb xc xd xe \<longrightarrow> True) \<and> (\<forall>xa xb. x = arch_capability.PageTableCap xa xb \<longrightarrow> True) \<and> (\<forall>xa xc. x = arch_capability.PageDirectoryCap xa xc \<longrightarrow> (xc = None \<longrightarrow> True \<and> True \<and> True \<and> True \<and> True \<and> (if isNothing ((armKSASIDTable \<circ> ksArchState) s (asidHighBitsOf (capASIDBase (arch_capability.ASIDPoolCap x11 x12)))) then \<lambda>s. True \<and> True else ((\<lambda>p s. \<not> p \<noteq> x11 \<longrightarrow> True \<and> (\<forall>ko. ko_at' ko p s \<longrightarrow> ((\<lambda>xa s. \<not> null (filter (\<lambda>a. case a of (x, y) \<Rightarrow> x \<le> 2 ^ local.asid_low_bits - 1 \<and> x + capASIDBase (arch_capability.ASIDPoolCap x11 x12) \<noteq> 0 \<and> y = None) (assocs xa)) \<longrightarrow> valid_arch_inv' (invocation.InvokeASIDPool (asidpool_invocation.Assign (fst (hd (filter (\<lambda>a. case a of (x, y) \<Rightarrow> x \<le> 2 ^ local.asid_low_bits - 1 \<and> x + capASIDBase (arch_capability.ASIDPoolCap x11 x12) \<noteq> 0 \<and> y = None) (assocs xa))) + capASIDBase (arch_capability.ASIDPoolCap x11 x12)) x11 xb)) s) \<circ> inv asidpool.ASIDPool) ko s)) \<circ> the) ((armKSASIDTable \<circ> ksArchState) s (asidHighBitsOf (capASIDBase (arch_capability.ASIDPoolCap x11 x12))))) s) \<and> (\<forall>x. xc = Some x \<longrightarrow> True))) \<and> (\<forall>x xb xc. xa = capability.ReplyCap x xb xc \<longrightarrow> True) \<and> (\<forall>x xb xc xd. xa = capability.UntypedCap x xb xc xd \<longrightarrow> True) \<and> (\<forall>x xb xc xd. xa = capability.CNodeCap x xb xc xd \<longrightarrow> True) \<and> (xa = capability.IRQControlCap \<longrightarrow> True)))) \<and> (x = ARMIRQIssueIRQHandler \<longrightarrow> True))
 2. arch_cap = arch_capability.ASIDControlCap \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>x12 s y b x xb ko. \<lbrakk>arch_cap = arch_capability.ASIDPoolCap y x12; invs' s; capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)); asid_pool_at' y s; is_aligned x12 local.asid_low_bits; x12 < 2 ^ local.asid_bits; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x12)) = Some y; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None), b) # x; ko_at' ko y s; \<not> null (filter (\<lambda>(x, y). x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko))); cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None)) \<circ> cteCap) b s; \<forall>x\<in>set x. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s\<rbrakk> \<Longrightarrow> cte_wp_at' (isPDCap \<circ> cteCap) b s \<and> 0 < fst (hd (filter (\<lambda>(x, y). x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12 \<and> fst (hd (filter (\<lambda>(x, y). x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12 < 2 ^ local.asid_bits
 2. arch_cap = arch_capability.ASIDControlCap \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>x12 s y b x xb ko. \<lbrakk>arch_cap = arch_capability.ASIDPoolCap y x12; invs' s; capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)); asid_pool_at' y s; is_aligned x12 local.asid_low_bits; x12 < 2 ^ local.asid_bits; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x12)) = Some y; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None), b) # x; ko_at' ko y s; \<not> null (filter (\<lambda>(x, y). x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko))); cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None)) \<circ> cteCap) b s; \<forall>x\<in>set x. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s\<rbrakk> \<Longrightarrow> cte_wp_at' (isPDCap \<circ> cteCap) b s
 2. \<And>x12 s y b x xb ko. \<lbrakk>arch_cap = arch_capability.ASIDPoolCap y x12; invs' s; capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)); asid_pool_at' y s; is_aligned x12 local.asid_low_bits; x12 < 2 ^ local.asid_bits; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x12)) = Some y; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None), b) # x; ko_at' ko y s; \<not> null (filter (\<lambda>(x, y). x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko))); cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None)) \<circ> cteCap) b s; \<forall>x\<in>set x. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s\<rbrakk> \<Longrightarrow> 0 < fst (hd (filter (\<lambda>(x, y). x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12 \<and> fst (hd (filter (\<lambda>(x, y). x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12 < 2 ^ local.asid_bits
 3. arch_cap = arch_capability.ASIDControlCap \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 6. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>x12 s y b x xb ko c. \<lbrakk>arch_cap = arch_capability.ASIDPoolCap y x12; invs' s; capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)); asid_pool_at' y s; is_aligned x12 local.asid_low_bits; x12 < 2 ^ local.asid_bits; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x12)) = Some y; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None), b) # x; ko_at' ko y s; \<not> null (filter (\<lambda>(x, y). x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko))); \<forall>x\<in>set x. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s; ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None)) \<circ> cteCap) c\<rbrakk> \<Longrightarrow> (isPDCap \<circ> cteCap) c
 2. \<And>x12 s y b x xb ko. \<lbrakk>arch_cap = arch_capability.ASIDPoolCap y x12; invs' s; capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)); asid_pool_at' y s; is_aligned x12 local.asid_low_bits; x12 < 2 ^ local.asid_bits; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x12)) = Some y; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None), b) # x; ko_at' ko y s; \<not> null (filter (\<lambda>(x, y). x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko))); cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None)) \<circ> cteCap) b s; \<forall>x\<in>set x. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s\<rbrakk> \<Longrightarrow> 0 < fst (hd (filter (\<lambda>(x, y). x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12 \<and> fst (hd (filter (\<lambda>(x, y). x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12 < 2 ^ local.asid_bits
 3. arch_cap = arch_capability.ASIDControlCap \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 6. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>x12 s y b x xb ko. \<lbrakk>arch_cap = arch_capability.ASIDPoolCap y x12; invs' s; capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)); asid_pool_at' y s; is_aligned x12 local.asid_low_bits; x12 < 2 ^ local.asid_bits; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x12)) = Some y; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None), b) # x; ko_at' ko y s; \<not> null (filter (\<lambda>(x, y). x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko))); cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None)) \<circ> cteCap) b s; \<forall>x\<in>set x. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s\<rbrakk> \<Longrightarrow> 0 < fst (hd (filter (\<lambda>(x, y). x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12 \<and> fst (hd (filter (\<lambda>(x, y). x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12 < 2 ^ local.asid_bits
 2. arch_cap = arch_capability.ASIDControlCap \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>x12 s y b x xb ko. \<lbrakk>arch_cap = arch_capability.ASIDPoolCap y x12; invs' s; capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)); asid_pool_at' y s; is_aligned x12 local.asid_low_bits; x12 < 2 ^ local.asid_bits; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x12)) = Some y; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None), b) # x; ko_at' ko y s; \<not> null (filter (\<lambda>(x, y). (x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12) \<and> y = None) (assocs (inv asidpool.ASIDPool ko))); cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None)) \<circ> cteCap) b s; \<forall>x\<in>set x. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s\<rbrakk> \<Longrightarrow> 0 < fst (hd (filter (\<lambda>(x, y). x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12 \<and> fst (hd (filter (\<lambda>(x, y). x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12 < 2 ^ local.asid_bits
 2. arch_cap = arch_capability.ASIDControlCap \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>x12 s y b x xb ko. \<lbrakk>arch_cap = arch_capability.ASIDPoolCap y x12; invs' s; capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)); asid_pool_at' y s; is_aligned x12 local.asid_low_bits; x12 < 2 ^ local.asid_bits; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x12)) = Some y; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None), b) # x; ko_at' ko y s; - dom (inv asidpool.ASIDPool ko) \<inter> {x. x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12} \<noteq> {}; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None)) \<circ> cteCap) b s; \<forall>x\<in>set x. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s\<rbrakk> \<Longrightarrow> 0 < fst (hd (filter (\<lambda>(x, y). x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12 \<and> fst (hd (filter (\<lambda>(x, y). x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12 < 2 ^ local.asid_bits
 2. arch_cap = arch_capability.ASIDControlCap \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>x12 s y b x xb ko. \<lbrakk>arch_cap = arch_capability.ASIDPoolCap y x12; invs' s; capAligned (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)); asid_pool_at' y s; is_aligned x12 local.asid_low_bits; x12 < 2 ^ local.asid_bits; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x12)) = Some y; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None), b) # x; ko_at' ko y s; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None)) \<circ> cteCap) b s; \<forall>x\<in>set x. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s; fst (hd (filter (\<lambda>(x, y). (x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12) \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) \<notin> dom (inv asidpool.ASIDPool ko) \<and> fst (hd (filter (\<lambda>(x, y). (x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12) \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < fst (hd (filter (\<lambda>(x, y). (x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12) \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12\<rbrakk> \<Longrightarrow> 0 < fst (hd (filter (\<lambda>(x, y). x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12 \<and> fst (hd (filter (\<lambda>(x, y). x \<le> 2 ^ local.asid_low_bits - 1 \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12 < 2 ^ local.asid_bits
 2. arch_cap = arch_capability.ASIDControlCap \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>x12 s y b x xb ko. \<lbrakk>arch_cap = arch_capability.ASIDPoolCap y x12; invs' s; is_aligned y (Suc (Suc local.asid_low_bits)) \<and> Suc (Suc local.asid_low_bits) < word_bits; asid_pool_at' y s; is_aligned x12 local.asid_low_bits; x12 < 2 ^ local.asid_bits; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x12)) = Some y; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None), b) # x; ko_at' ko y s; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None)) \<circ> cteCap) b s; \<forall>x\<in>set x. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s; fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) \<notin> dom (inv asidpool.ASIDPool ko) \<and> fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) < 2 ^ local.asid_low_bits \<and> 0 < fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12\<rbrakk> \<Longrightarrow> fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12 < 2 ^ local.asid_bits
 2. arch_cap = arch_capability.ASIDControlCap \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>x12 s y b x xb ko. \<lbrakk>arch_cap = arch_capability.ASIDPoolCap y x12; invs' s; asid_pool_at' y s; is_aligned x12 local.asid_low_bits; x12 < 2 ^ local.asid_bits; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x12)) = Some y; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None), b) # x; ko_at' ko y s; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None)) \<circ> cteCap) b s; \<forall>x\<in>set x. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s; is_aligned y (Suc (Suc local.asid_low_bits)); Suc (Suc local.asid_low_bits) < word_bits; fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) \<notin> dom (inv asidpool.ASIDPool ko); fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) < 2 ^ local.asid_low_bits; 0 < fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12\<rbrakk> \<Longrightarrow> fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12 < 2 ^ local.asid_bits
 2. arch_cap = arch_capability.ASIDControlCap \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (7 subgoals):
 1. \<And>x12 s y b x xb ko. \<lbrakk>arch_cap = arch_capability.ASIDPoolCap y x12; invs' s; asid_pool_at' y s; x12 < 2 ^ local.asid_bits; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x12)) = Some y; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None), b) # x; ko_at' ko y s; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None)) \<circ> cteCap) b s; \<forall>x\<in>set x. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s; is_aligned y (Suc (Suc local.asid_low_bits)); Suc (Suc local.asid_low_bits) < word_bits; fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) \<notin> dom (inv asidpool.ASIDPool ko); fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) < 2 ^ local.asid_low_bits; 0 < fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12\<rbrakk> \<Longrightarrow> fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) < 2 ^ local.asid_low_bits
 2. \<And>x12 s y b x xb ko. \<lbrakk>arch_cap = arch_capability.ASIDPoolCap y x12; invs' s; asid_pool_at' y s; x12 < 2 ^ local.asid_bits; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x12)) = Some y; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None), b) # x; ko_at' ko y s; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None)) \<circ> cteCap) b s; \<forall>x\<in>set x. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s; is_aligned y (Suc (Suc local.asid_low_bits)); Suc (Suc local.asid_low_bits) < word_bits; fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) \<notin> dom (inv asidpool.ASIDPool ko); fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) < 2 ^ local.asid_low_bits; 0 < fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12\<rbrakk> \<Longrightarrow> local.asid_low_bits \<le> local.asid_bits
 3. \<And>x12 s y b x xb ko. \<lbrakk>arch_cap = arch_capability.ASIDPoolCap y x12; invs' s; asid_pool_at' y s; x12 < 2 ^ local.asid_bits; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x12)) = Some y; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None), b) # x; ko_at' ko y s; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None)) \<circ> cteCap) b s; \<forall>x\<in>set x. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s; is_aligned y (Suc (Suc local.asid_low_bits)); Suc (Suc local.asid_low_bits) < word_bits; fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) \<notin> dom (inv asidpool.ASIDPool ko); fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) < 2 ^ local.asid_low_bits; 0 < fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12\<rbrakk> \<Longrightarrow> x12 < 2 ^ local.asid_bits
 4. arch_cap = arch_capability.ASIDControlCap \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 6. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 7. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>x12 s y b x xb ko. \<lbrakk>arch_cap = arch_capability.ASIDPoolCap y x12; invs' s; asid_pool_at' y s; x12 < 2 ^ local.asid_bits; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x12)) = Some y; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None), b) # x; ko_at' ko y s; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None)) \<circ> cteCap) b s; \<forall>x\<in>set x. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s; is_aligned y (Suc (Suc local.asid_low_bits)); Suc (Suc local.asid_low_bits) < word_bits; fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) \<notin> dom (inv asidpool.ASIDPool ko); fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) < 2 ^ local.asid_low_bits; 0 < fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12\<rbrakk> \<Longrightarrow> local.asid_low_bits \<le> local.asid_bits
 2. \<And>x12 s y b x xb ko. \<lbrakk>arch_cap = arch_capability.ASIDPoolCap y x12; invs' s; asid_pool_at' y s; x12 < 2 ^ local.asid_bits; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x12)) = Some y; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None), b) # x; ko_at' ko y s; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None)) \<circ> cteCap) b s; \<forall>x\<in>set x. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s; is_aligned y (Suc (Suc local.asid_low_bits)); Suc (Suc local.asid_low_bits) < word_bits; fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) \<notin> dom (inv asidpool.ASIDPool ko); fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) < 2 ^ local.asid_low_bits; 0 < fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12\<rbrakk> \<Longrightarrow> x12 < 2 ^ local.asid_bits
 3. arch_cap = arch_capability.ASIDControlCap \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 6. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>x12 s y b x xb ko. \<lbrakk>arch_cap = arch_capability.ASIDPoolCap y x12; invs' s; asid_pool_at' y s; x12 < 2 ^ local.asid_bits; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.ASIDPoolCap y x12)) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; armKSASIDTable (ksArchState s) (UCAST(7 \<rightarrow> 32) (asid_high_bits_of x12)) = Some y; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None), b) # x; ko_at' ko y s; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap xb None)) \<circ> cteCap) b s; \<forall>x\<in>set x. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s; is_aligned y (Suc (Suc local.asid_low_bits)); Suc (Suc local.asid_low_bits) < word_bits; fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) \<notin> dom (inv asidpool.ASIDPool ko); fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) < 2 ^ local.asid_low_bits; 0 < fst (hd (filter (\<lambda>(x, y). x < 2 ^ local.asid_low_bits \<and> 0 < x + x12 \<and> y = None) (assocs (inv asidpool.ASIDPool ko)))) + x12\<rbrakk> \<Longrightarrow> x12 < 2 ^ local.asid_bits
 2. arch_cap = arch_capability.ASIDControlCap \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. arch_cap = arch_capability.ASIDControlCap \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. arch_cap = arch_capability.ASIDControlCap \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throwError Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMASIDControlMakePool \<Rightarrow> case args of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | [index] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | index # depth # x \<Rightarrow> case excaps of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | [ab] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | ab # aba # xb \<Rightarrow> doE asidTable <- liftE (gets (armKSASIDTable \<circ> ksArchState));
y <- whenE (null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) (throwError Fault_H.syscall_error.DeleteFirst);
frame <- if (\<exists>d v0 v1 f. fst ab = capability.UntypedCap d v0 v1 f) \<and> \<not> capIsDevice (fst ab) \<and> capBlockSize (fst ab) = objBits makeObject then doE y <- ensureNoChildren (snd ab);
returnOk (capPtr (fst ab))
odE else throwError (Fault_H.syscall_error.InvalidCapability (Suc 0));
destSlot <- lookupTargetSlot (fst aba) index (unat depth);
y <- ensureEmptySlot destSlot;
returnOk (invocation.InvokeASIDControl (asidcontrol_invocation.MakePool frame destSlot (snd ab) (fst (hd (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) << local.asid_low_bits)))
odE | ArchInvocationLabel _ \<Rightarrow> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. arch_cap = arch_capability.ASIDControlCap \<Longrightarrow> \<lbrace>?P'564\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throwError Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMASIDControlMakePool \<Rightarrow> case args of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | [index] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | index # depth # x \<Rightarrow> case excaps of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | [ab] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | ab # aba # xb \<Rightarrow> doE asidTable <- liftE (gets (armKSASIDTable \<circ> ksArchState));
y <- whenE (null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) (throwError Fault_H.syscall_error.DeleteFirst);
frame <- if (\<exists>d v0 v1 f. fst ab = capability.UntypedCap d v0 v1 f) \<and> \<not> capIsDevice (fst ab) \<and> capBlockSize (fst ab) = objBits makeObject then doE y <- ensureNoChildren (snd ab);
returnOk (capPtr (fst ab))
odE else throwError (Fault_H.syscall_error.InvalidCapability (Suc 0));
destSlot <- lookupTargetSlot (fst aba) index (unat depth);
y <- ensureEmptySlot destSlot;
returnOk (invocation.InvokeASIDControl (asidcontrol_invocation.MakePool frame destSlot (snd ab) (fst (hd (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) << local.asid_low_bits)))
odE | ArchInvocationLabel _ \<Rightarrow> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>s. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; (invs' and valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> ?P'564 s
 3. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (10 subgoals):
 1. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable frame. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; x2 = ARMASIDControlMakePool; args = x21 # x21a # x22a; x22 = x21a # x22a; excaps = x21b # x21c # x22c; x22b = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?P'763 ARMASIDControlMakePool x21 (x21a # x22a) x21a x22a x21b (x21c # x22c) x21c x22c asidTable () frame\<rbrace> lookupTargetSlot (fst x21c) x21 (unat x21a) \<lbrace>\<lambda>rv s. cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) rv s \<longrightarrow> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False frame pageBits idx) (snd x21b) s \<and> descendants_of' (snd x21b) (ctes_of s) = {} \<and> rv \<noteq> snd x21b \<and> ex_cte_cap_wp_to' (\<lambda>_. True) rv s \<and> sch_act_simple s \<and> fst (hd (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) << local.asid_low_bits < 2 ^ local.asid_bits\<rbrace>, -
 2. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable y. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDControlMakePool; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b; x22b = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B752 x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable y\<rbrace> if (\<exists>d v0 v1 f. fst x21b = capability.UntypedCap d v0 v1 f) \<and> \<not> capIsDevice (fst x21b) \<and> capBlockSize (fst x21b) = objBits makeObject then doE y <- ensureNoChildren (snd x21b);
returnOk (capPtr (fst x21b))
odE else throwError (Fault_H.syscall_error.InvalidCapability (Suc 0)) \<lbrace>\<lambda>frame s. True \<and> True \<and> ?P'763 x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable y frame s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDControlMakePool; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b; x22b = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B751 x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable\<rbrace> whenE (null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) (throwError Fault_H.syscall_error.DeleteFirst) \<lbrace>?B752 x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDControlMakePool; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b; x22b = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?R744 x2 x21 x22 x21a x22a x21b x22b x21c x22c\<rbrace> liftE (gets (armKSASIDTable \<circ> ksArchState)) \<lbrace>?B751 x2 x21 x22 x21a x22a x21b x22b x21c x22c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x2. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> \<lbrace>?R603 x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 6. \<And>x2. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> \<lbrace>?R602 x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 7. \<And>s. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; (invs' and valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (\<forall>x. invocation_type label = GenInvocationLabel x \<longrightarrow> True) \<and> (\<forall>x. invocation_type label = ArchInvocationLabel x \<longrightarrow> (x = ARMPDClean_Data \<longrightarrow> True) \<and> (x = ARMPDInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPDCleanInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPDUnify_Instruction \<longrightarrow> True) \<and> (x = ARMPageTableMap \<longrightarrow> True) \<and> (x = ARMPageTableUnmap \<longrightarrow> True) \<and> (x = ARMPageMap \<longrightarrow> True) \<and> (x = ARMPageUnmap \<longrightarrow> True) \<and> (x = ARMPageClean_Data \<longrightarrow> True) \<and> (x = ARMPageInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPageCleanInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPageUnify_Instruction \<longrightarrow> True) \<and> (x = ARMPageGetAddress \<longrightarrow> True) \<and> (x = ARMASIDControlMakePool \<longrightarrow> (args = [] \<longrightarrow> True) \<and> (\<forall>xa xb. args = xa # xb \<longrightarrow> (xb = [] \<longrightarrow> True) \<and> (\<forall>xc xd. xb = xc # xd \<longrightarrow> (excaps = [] \<longrightarrow> True) \<and> (\<forall>xe xf. excaps = xe # xf \<longrightarrow> (xf = [] \<longrightarrow> True) \<and> (\<forall>xg xh. xf = xg # xh \<longrightarrow> ?R744 x xa xb xc xd xe xf xg xh s))))) \<and> (x = ARMASIDPoolAssign \<longrightarrow> ?R603 x s) \<and> (x = ARMIRQIssueIRQHandler \<longrightarrow> ?R602 x s))
 8. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 9. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 10. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (11 subgoals):
 1. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable frame. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; x2 = ARMASIDControlMakePool; args = x21 # x21a # x22a; x22 = x21a # x22a; excaps = x21b # x21c # x22c; x22b = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?P'763 ARMASIDControlMakePool x21 (x21a # x22a) x21a x22a x21b (x21c # x22c) x21c x22c asidTable () frame\<rbrace> lookupTargetSlot (fst x21c) x21 (unat x21a) \<lbrace>\<lambda>rv. K (fst (hd (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) << local.asid_low_bits \<le> 2 ^ local.asid_bits - 1) and real_cte_at' rv and ex_cte_cap_wp_to' (\<lambda>_. True) rv and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False frame pageBits idx) (snd (excaps ! 0)) and sch_act_simple and (\<lambda>s. descendants_of' (snd (excaps ! 0)) (ctes_of s) = {})\<rbrace>, -
 2. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable frame rv s. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; x2 = ARMASIDControlMakePool; args = x21 # x21a # x22a; x22 = x21a # x22a; excaps = x21b # x21c # x22c; x22b = x21c # x22c; (K (fst (hd (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) << local.asid_low_bits \<le> 2 ^ local.asid_bits - 1) and real_cte_at' rv and ex_cte_cap_wp_to' (\<lambda>_. True) rv and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False frame pageBits idx) (snd (excaps ! 0)) and sch_act_simple and (\<lambda>s. descendants_of' (snd (excaps ! 0)) (ctes_of s) = {})) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) rv s \<longrightarrow> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False frame pageBits idx) (snd x21b) s \<and> descendants_of' (snd x21b) (ctes_of s) = {} \<and> rv \<noteq> snd x21b \<and> ex_cte_cap_wp_to' (\<lambda>_. True) rv s \<and> sch_act_simple s \<and> fst (hd (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) << local.asid_low_bits < 2 ^ local.asid_bits
 3. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable y. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDControlMakePool; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b; x22b = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B752 x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable y\<rbrace> if (\<exists>d v0 v1 f. fst x21b = capability.UntypedCap d v0 v1 f) \<and> \<not> capIsDevice (fst x21b) \<and> capBlockSize (fst x21b) = objBits makeObject then doE y <- ensureNoChildren (snd x21b);
returnOk (capPtr (fst x21b))
odE else throwError (Fault_H.syscall_error.InvalidCapability (Suc 0)) \<lbrace>\<lambda>frame s. True \<and> True \<and> ?P'763 x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable y frame s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDControlMakePool; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b; x22b = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B751 x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable\<rbrace> whenE (null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) (throwError Fault_H.syscall_error.DeleteFirst) \<lbrace>?B752 x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDControlMakePool; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b; x22b = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?R744 x2 x21 x22 x21a x22a x21b x22b x21c x22c\<rbrace> liftE (gets (armKSASIDTable \<circ> ksArchState)) \<lbrace>?B751 x2 x21 x22 x21a x22a x21b x22b x21c x22c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x2. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> \<lbrace>?R603 x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 7. \<And>x2. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> \<lbrace>?R602 x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 8. \<And>s. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; (invs' and valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (\<forall>x. invocation_type label = GenInvocationLabel x \<longrightarrow> True) \<and> (\<forall>x. invocation_type label = ArchInvocationLabel x \<longrightarrow> (x = ARMPDClean_Data \<longrightarrow> True) \<and> (x = ARMPDInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPDCleanInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPDUnify_Instruction \<longrightarrow> True) \<and> (x = ARMPageTableMap \<longrightarrow> True) \<and> (x = ARMPageTableUnmap \<longrightarrow> True) \<and> (x = ARMPageMap \<longrightarrow> True) \<and> (x = ARMPageUnmap \<longrightarrow> True) \<and> (x = ARMPageClean_Data \<longrightarrow> True) \<and> (x = ARMPageInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPageCleanInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPageUnify_Instruction \<longrightarrow> True) \<and> (x = ARMPageGetAddress \<longrightarrow> True) \<and> (x = ARMASIDControlMakePool \<longrightarrow> (args = [] \<longrightarrow> True) \<and> (\<forall>xa xb. args = xa # xb \<longrightarrow> (xb = [] \<longrightarrow> True) \<and> (\<forall>xc xd. xb = xc # xd \<longrightarrow> (excaps = [] \<longrightarrow> True) \<and> (\<forall>xe xf. excaps = xe # xf \<longrightarrow> (xf = [] \<longrightarrow> True) \<and> (\<forall>xg xh. xf = xg # xh \<longrightarrow> ?R744 x xa xb xc xd xe xf xg xh s))))) \<and> (x = ARMASIDPoolAssign \<longrightarrow> ?R603 x s) \<and> (x = ARMIRQIssueIRQHandler \<longrightarrow> ?R602 x s))
 9. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 10. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable frame. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; x2 = ARMASIDControlMakePool; args = x21 # x21a # x22a; x22 = x21a # x22a; excaps = x21b # x21c # x22c; x22b = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?P'763 ARMASIDControlMakePool x21 (x21a # x22a) x21a x22a x21b (x21c # x22c) x21c x22c asidTable () frame\<rbrace> lookupSlotForCNodeOp False (fst x21c) x21 (unat x21a) \<lbrace>\<lambda>rv. (\<lambda>y. fst (hd (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) << local.asid_low_bits < 2 ^ local.asid_bits) and real_cte_at' rv and ex_cte_cap_wp_to' (\<lambda>_. True) rv and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False frame pageBits idx) (snd x21b) and sch_act_simple and (\<lambda>s. descendants_of' (snd x21b) (ctes_of s) = {})\<rbrace>, -
 2. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable frame rv s. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; x2 = ARMASIDControlMakePool; args = x21 # x21a # x22a; x22 = x21a # x22a; excaps = x21b # x21c # x22c; x22b = x21c # x22c; (K (fst (hd (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) << local.asid_low_bits \<le> 2 ^ local.asid_bits - 1) and real_cte_at' rv and ex_cte_cap_wp_to' (\<lambda>_. True) rv and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False frame pageBits idx) (snd (excaps ! 0)) and sch_act_simple and (\<lambda>s. descendants_of' (snd (excaps ! 0)) (ctes_of s) = {})) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) rv s \<longrightarrow> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False frame pageBits idx) (snd x21b) s \<and> descendants_of' (snd x21b) (ctes_of s) = {} \<and> rv \<noteq> snd x21b \<and> ex_cte_cap_wp_to' (\<lambda>_. True) rv s \<and> sch_act_simple s \<and> fst (hd (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) << local.asid_low_bits < 2 ^ local.asid_bits
 3. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable y. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDControlMakePool; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b; x22b = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B752 x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable y\<rbrace> if (\<exists>d v0 v1 f. fst x21b = capability.UntypedCap d v0 v1 f) \<and> \<not> capIsDevice (fst x21b) \<and> capBlockSize (fst x21b) = objBits makeObject then doE y <- ensureNoChildren (snd x21b);
returnOk (capPtr (fst x21b))
odE else throwError (Fault_H.syscall_error.InvalidCapability (Suc 0)) \<lbrace>\<lambda>frame s. True \<and> True \<and> ?P'763 x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable y frame s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDControlMakePool; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b; x22b = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B751 x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable\<rbrace> whenE (null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) (throwError Fault_H.syscall_error.DeleteFirst) \<lbrace>?B752 x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDControlMakePool; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b; x22b = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?R744 x2 x21 x22 x21a x22a x21b x22b x21c x22c\<rbrace> liftE (gets (armKSASIDTable \<circ> ksArchState)) \<lbrace>?B751 x2 x21 x22 x21a x22a x21b x22b x21c x22c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x2. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> \<lbrace>?R603 x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 7. \<And>x2. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> \<lbrace>?R602 x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 8. \<And>s. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; (invs' and valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (\<forall>x. invocation_type label = GenInvocationLabel x \<longrightarrow> True) \<and> (\<forall>x. invocation_type label = ArchInvocationLabel x \<longrightarrow> (x = ARMPDClean_Data \<longrightarrow> True) \<and> (x = ARMPDInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPDCleanInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPDUnify_Instruction \<longrightarrow> True) \<and> (x = ARMPageTableMap \<longrightarrow> True) \<and> (x = ARMPageTableUnmap \<longrightarrow> True) \<and> (x = ARMPageMap \<longrightarrow> True) \<and> (x = ARMPageUnmap \<longrightarrow> True) \<and> (x = ARMPageClean_Data \<longrightarrow> True) \<and> (x = ARMPageInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPageCleanInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPageUnify_Instruction \<longrightarrow> True) \<and> (x = ARMPageGetAddress \<longrightarrow> True) \<and> (x = ARMASIDControlMakePool \<longrightarrow> (args = [] \<longrightarrow> True) \<and> (\<forall>xa xb. args = xa # xb \<longrightarrow> (xb = [] \<longrightarrow> True) \<and> (\<forall>xc xd. xb = xc # xd \<longrightarrow> (excaps = [] \<longrightarrow> True) \<and> (\<forall>xe xf. excaps = xe # xf \<longrightarrow> (xf = [] \<longrightarrow> True) \<and> (\<forall>xg xh. xf = xg # xh \<longrightarrow> ?R744 x xa xb xc xd xe xf xg xh s))))) \<and> (x = ARMASIDPoolAssign \<longrightarrow> ?R603 x s) \<and> (x = ARMIRQIssueIRQHandler \<longrightarrow> ?R602 x s))
 9. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 10. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable frame rv s. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; x2 = ARMASIDControlMakePool; args = x21 # x21a # x22a; x22 = x21a # x22a; excaps = x21b # x21c # x22c; x22b = x21c # x22c; (K (fst (hd (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) << local.asid_low_bits \<le> 2 ^ local.asid_bits - 1) and real_cte_at' rv and ex_cte_cap_wp_to' (\<lambda>_. True) rv and cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False frame pageBits idx) (snd (excaps ! 0)) and sch_act_simple and (\<lambda>s. descendants_of' (snd (excaps ! 0)) (ctes_of s) = {})) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>c. cteCap c = capability.NullCap) rv s \<longrightarrow> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False frame pageBits idx) (snd x21b) s \<and> descendants_of' (snd x21b) (ctes_of s) = {} \<and> rv \<noteq> snd x21b \<and> ex_cte_cap_wp_to' (\<lambda>_. True) rv s \<and> sch_act_simple s \<and> fst (hd (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) << local.asid_low_bits < 2 ^ local.asid_bits
 2. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable y. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDControlMakePool; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b; x22b = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B752 x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable y\<rbrace> if (\<exists>d v0 v1 f. fst x21b = capability.UntypedCap d v0 v1 f) \<and> \<not> capIsDevice (fst x21b) \<and> capBlockSize (fst x21b) = objBits makeObject then doE y <- ensureNoChildren (snd x21b);
returnOk (capPtr (fst x21b))
odE else throwError (Fault_H.syscall_error.InvalidCapability (Suc 0)) \<lbrace>\<lambda>frame s. True \<and> True \<and> fst (hd (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) << local.asid_low_bits < 2 ^ local.asid_bits \<and> (valid_objs' and valid_cap' (fst x21c)) s \<and> (\<forall>r\<in>cte_refs' (fst x21c) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False frame pageBits idx) (snd x21b) s \<and> sch_act_simple s \<and> descendants_of' (snd x21b) (ctes_of s) = {}\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDControlMakePool; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b; x22b = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B751 x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable\<rbrace> whenE (null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) (throwError Fault_H.syscall_error.DeleteFirst) \<lbrace>?B752 x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDControlMakePool; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b; x22b = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?R744 x2 x21 x22 x21a x22a x21b x22b x21c x22c\<rbrace> liftE (gets (armKSASIDTable \<circ> ksArchState)) \<lbrace>?B751 x2 x21 x22 x21a x22a x21b x22b x21c x22c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x2. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> \<lbrace>?R603 x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 6. \<And>x2. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> \<lbrace>?R602 x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 7. \<And>s. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; (invs' and valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (\<forall>x. invocation_type label = GenInvocationLabel x \<longrightarrow> True) \<and> (\<forall>x. invocation_type label = ArchInvocationLabel x \<longrightarrow> (x = ARMPDClean_Data \<longrightarrow> True) \<and> (x = ARMPDInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPDCleanInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPDUnify_Instruction \<longrightarrow> True) \<and> (x = ARMPageTableMap \<longrightarrow> True) \<and> (x = ARMPageTableUnmap \<longrightarrow> True) \<and> (x = ARMPageMap \<longrightarrow> True) \<and> (x = ARMPageUnmap \<longrightarrow> True) \<and> (x = ARMPageClean_Data \<longrightarrow> True) \<and> (x = ARMPageInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPageCleanInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPageUnify_Instruction \<longrightarrow> True) \<and> (x = ARMPageGetAddress \<longrightarrow> True) \<and> (x = ARMASIDControlMakePool \<longrightarrow> (args = [] \<longrightarrow> True) \<and> (\<forall>xa xb. args = xa # xb \<longrightarrow> (xb = [] \<longrightarrow> True) \<and> (\<forall>xc xd. xb = xc # xd \<longrightarrow> (excaps = [] \<longrightarrow> True) \<and> (\<forall>xe xf. excaps = xe # xf \<longrightarrow> (xf = [] \<longrightarrow> True) \<and> (\<forall>xg xh. xf = xg # xh \<longrightarrow> ?R744 x xa xb xc xd xe xf xg xh s))))) \<and> (x = ARMASIDPoolAssign \<longrightarrow> ?R603 x s) \<and> (x = ARMIRQIssueIRQHandler \<longrightarrow> ?R602 x s))
 8. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 9. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 10. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (9 subgoals):
 1. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable y. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDControlMakePool; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b; x22b = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B752 x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable y\<rbrace> if (\<exists>d v0 v1 f. fst x21b = capability.UntypedCap d v0 v1 f) \<and> \<not> capIsDevice (fst x21b) \<and> capBlockSize (fst x21b) = objBits makeObject then doE y <- ensureNoChildren (snd x21b);
returnOk (capPtr (fst x21b))
odE else throwError (Fault_H.syscall_error.InvalidCapability (Suc 0)) \<lbrace>\<lambda>frame s. True \<and> True \<and> fst (hd (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) << local.asid_low_bits < 2 ^ local.asid_bits \<and> (valid_objs' and valid_cap' (fst x21c)) s \<and> (\<forall>r\<in>cte_refs' (fst x21c) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False frame pageBits idx) (snd x21b) s \<and> sch_act_simple s \<and> descendants_of' (snd x21b) (ctes_of s) = {}\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDControlMakePool; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b; x22b = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B751 x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable\<rbrace> whenE (null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) (throwError Fault_H.syscall_error.DeleteFirst) \<lbrace>?B752 x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDControlMakePool; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b; x22b = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?R744 x2 x21 x22 x21a x22a x21b x22b x21c x22c\<rbrace> liftE (gets (armKSASIDTable \<circ> ksArchState)) \<lbrace>?B751 x2 x21 x22 x21a x22a x21b x22b x21c x22c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x2. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> \<lbrace>?R603 x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x2. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> \<lbrace>?R602 x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 6. \<And>s. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; (invs' and valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (\<forall>x. invocation_type label = GenInvocationLabel x \<longrightarrow> True) \<and> (\<forall>x. invocation_type label = ArchInvocationLabel x \<longrightarrow> (x = ARMPDClean_Data \<longrightarrow> True) \<and> (x = ARMPDInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPDCleanInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPDUnify_Instruction \<longrightarrow> True) \<and> (x = ARMPageTableMap \<longrightarrow> True) \<and> (x = ARMPageTableUnmap \<longrightarrow> True) \<and> (x = ARMPageMap \<longrightarrow> True) \<and> (x = ARMPageUnmap \<longrightarrow> True) \<and> (x = ARMPageClean_Data \<longrightarrow> True) \<and> (x = ARMPageInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPageCleanInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPageUnify_Instruction \<longrightarrow> True) \<and> (x = ARMPageGetAddress \<longrightarrow> True) \<and> (x = ARMASIDControlMakePool \<longrightarrow> (args = [] \<longrightarrow> True) \<and> (\<forall>xa xb. args = xa # xb \<longrightarrow> (xb = [] \<longrightarrow> True) \<and> (\<forall>xc xd. xb = xc # xd \<longrightarrow> (excaps = [] \<longrightarrow> True) \<and> (\<forall>xe xf. excaps = xe # xf \<longrightarrow> (xf = [] \<longrightarrow> True) \<and> (\<forall>xg xh. xf = xg # xh \<longrightarrow> ?R744 x xa xb xc xd xe xf xg xh s))))) \<and> (x = ARMASIDPoolAssign \<longrightarrow> ?R603 x s) \<and> (x = ARMIRQIssueIRQHandler \<longrightarrow> ?R602 x s))
 7. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 8. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 9. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (9 subgoals):
 1. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; x2 = ARMASIDControlMakePool; args = x21 # x21a # x22a; x22 = x21a # x22a; excaps = x21b # x21c # x22c; x22b = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B752 ARMASIDControlMakePool x21 (x21a # x22a) x21a x22a x21b (x21c # x22c) x21c x22c asidTable ()\<rbrace> if (\<exists>d v0 v1 f. fst x21b = capability.UntypedCap d v0 v1 f) \<and> \<not> capIsDevice (fst x21b) \<and> capBlockSize (fst x21b) = objBits makeObject then doE y <- ensureNoChildren (snd x21b);
returnOk (capPtr (fst x21b))
odE else throwError (Fault_H.syscall_error.InvalidCapability (Suc 0)) \<lbrace>\<lambda>frame s. fst (hd (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) << local.asid_low_bits < 2 ^ local.asid_bits \<and> valid_objs' s \<and> valid_cap' (fst x21c) s \<and> (\<forall>r\<in>cte_refs' (fst x21c) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False frame pageBits idx) (snd x21b) s \<and> sch_act_simple s \<and> descendants_of' (snd x21b) (ctes_of s) = {}\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDControlMakePool; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b; x22b = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B751 x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable\<rbrace> whenE (null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs asidTable))) (throwError Fault_H.syscall_error.DeleteFirst) \<lbrace>?B752 x2 x21 x22 x21a x22a x21b x22b x21c x22c asidTable\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x2 x21 x22 x21a x22a x21b x22b x21c x22c. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDControlMakePool; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b; x22b = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?R744 x2 x21 x22 x21a x22a x21b x22b x21c x22c\<rbrace> liftE (gets (armKSASIDTable \<circ> ksArchState)) \<lbrace>?B751 x2 x21 x22 x21a x22a x21b x22b x21c x22c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x2. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMASIDPoolAssign\<rbrakk> \<Longrightarrow> \<lbrace>?R603 x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x2. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invocation_type label = ArchInvocationLabel x2; x2 = ARMIRQIssueIRQHandler\<rbrakk> \<Longrightarrow> \<lbrace>?R602 x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 6. \<And>s. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; (invs' and valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (\<forall>x. invocation_type label = GenInvocationLabel x \<longrightarrow> True) \<and> (\<forall>x. invocation_type label = ArchInvocationLabel x \<longrightarrow> (x = ARMPDClean_Data \<longrightarrow> True) \<and> (x = ARMPDInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPDCleanInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPDUnify_Instruction \<longrightarrow> True) \<and> (x = ARMPageTableMap \<longrightarrow> True) \<and> (x = ARMPageTableUnmap \<longrightarrow> True) \<and> (x = ARMPageMap \<longrightarrow> True) \<and> (x = ARMPageUnmap \<longrightarrow> True) \<and> (x = ARMPageClean_Data \<longrightarrow> True) \<and> (x = ARMPageInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPageCleanInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPageUnify_Instruction \<longrightarrow> True) \<and> (x = ARMPageGetAddress \<longrightarrow> True) \<and> (x = ARMASIDControlMakePool \<longrightarrow> (args = [] \<longrightarrow> True) \<and> (\<forall>xa xb. args = xa # xb \<longrightarrow> (xb = [] \<longrightarrow> True) \<and> (\<forall>xc xd. xb = xc # xd \<longrightarrow> (excaps = [] \<longrightarrow> True) \<and> (\<forall>xe xf. excaps = xe # xf \<longrightarrow> (xf = [] \<longrightarrow> True) \<and> (\<forall>xg xh. xf = xg # xh \<longrightarrow> ?R744 x xa xb xc xd xe xf xg xh s))))) \<and> (x = ARMASIDPoolAssign \<longrightarrow> ?R603 x s) \<and> (x = ARMIRQIssueIRQHandler \<longrightarrow> ?R602 x s))
 7. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 8. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 9. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; (invs' and valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (\<forall>x. invocation_type label = GenInvocationLabel x \<longrightarrow> True) \<and> (\<forall>x. invocation_type label = ArchInvocationLabel x \<longrightarrow> (x = ARMPDClean_Data \<longrightarrow> True) \<and> (x = ARMPDInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPDCleanInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPDUnify_Instruction \<longrightarrow> True) \<and> (x = ARMPageTableMap \<longrightarrow> True) \<and> (x = ARMPageTableUnmap \<longrightarrow> True) \<and> (x = ARMPageMap \<longrightarrow> True) \<and> (x = ARMPageUnmap \<longrightarrow> True) \<and> (x = ARMPageClean_Data \<longrightarrow> True) \<and> (x = ARMPageInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPageCleanInvalidate_Data \<longrightarrow> True) \<and> (x = ARMPageUnify_Instruction \<longrightarrow> True) \<and> (x = ARMPageGetAddress \<longrightarrow> True) \<and> (x = ARMASIDControlMakePool \<longrightarrow> (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>x xb. xa = x # xb \<longrightarrow> (excaps = [] \<longrightarrow> True) \<and> (\<forall>x xa. excaps = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> True \<and> (\<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs ((armKSASIDTable \<circ> ksArchState) s))) \<longrightarrow> True \<and> fst (hd (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs ((armKSASIDTable \<circ> ksArchState) s)))) << local.asid_low_bits < 2 ^ local.asid_bits \<and> ((\<exists>d v0 v1 f. fst x = capability.UntypedCap d v0 v1 f) \<and> \<not> capIsDevice (fst x) \<and> capBlockSize (fst x) = objBits makeObject \<longrightarrow> True \<and> valid_objs' s \<and> valid_cap' (fst xb) s \<and> (\<forall>r\<in>cte_refs' (fst xb) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False (capPtr (fst x)) pageBits idx) (snd x) s \<and> sch_act_simple s) \<and> (\<not> ((\<exists>d v0 v1 f. fst x = capability.UntypedCap d v0 v1 f) \<and> \<not> capIsDevice (fst x) \<and> capBlockSize (fst x) = objBits makeObject) \<longrightarrow> True))))))) \<and> (x = ARMASIDPoolAssign \<longrightarrow> True) \<and> (x = ARMIRQIssueIRQHandler \<longrightarrow> True))
 2. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s x xb xc a b aa ba xe. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (a, b) # (aa, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); cte_wp_at' ((=) a \<circ> cteCap) b s; cte_wp_at' ((=) aa \<circ> cteCap) ba s; \<forall>x\<in>set xe. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s\<rbrakk> \<Longrightarrow> fst (hd (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s))))) << local.asid_low_bits < 2 ^ local.asid_bits \<and> ((\<exists>d v0 v1 f. a = capability.UntypedCap d v0 v1 f) \<and> \<not> capIsDevice a \<and> capBlockSize a = objBits makeObject \<longrightarrow> valid_objs' s \<and> valid_cap' aa s \<and> (\<forall>r\<in>cte_refs' aa (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False (capPtr a) pageBits idx) b s)
 2. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s x xb xc a b aa ba xe. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (a, b) # (aa, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); cte_wp_at' ((=) a \<circ> cteCap) b s; cte_wp_at' ((=) aa \<circ> cteCap) ba s; \<forall>x\<in>set xe. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s\<rbrakk> \<Longrightarrow> fst (hd (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s))))) << local.asid_low_bits < 2 ^ local.asid_bits
 2. \<And>s x xb xc a b aa ba xe. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (a, b) # (aa, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); cte_wp_at' ((=) a \<circ> cteCap) b s; cte_wp_at' ((=) aa \<circ> cteCap) ba s; \<forall>x\<in>set xe. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s\<rbrakk> \<Longrightarrow> (\<exists>d v0 v1 f. a = capability.UntypedCap d v0 v1 f) \<and> \<not> capIsDevice a \<and> capBlockSize a = objBits makeObject \<longrightarrow> valid_objs' s \<and> valid_cap' aa s \<and> (\<forall>r\<in>cte_refs' aa (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False (capPtr a) pageBits idx) b s
 3. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s x xb xc a b aa ba xe ab bb ys. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (a, b) # (aa, ba) # xe; cte_wp_at' ((=) a \<circ> cteCap) b s; cte_wp_at' ((=) aa \<circ> cteCap) ba s; \<forall>x\<in>set xe. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s; filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s))) = (ab, bb) # ys\<rbrakk> \<Longrightarrow> ab << local.asid_low_bits < 2 ^ local.asid_bits
 2. \<And>s x xb xc a b aa ba xe. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (a, b) # (aa, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); cte_wp_at' ((=) a \<circ> cteCap) b s; cte_wp_at' ((=) aa \<circ> cteCap) ba s; \<forall>x\<in>set xe. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s\<rbrakk> \<Longrightarrow> (\<exists>d v0 v1 f. a = capability.UntypedCap d v0 v1 f) \<and> \<not> capIsDevice a \<and> capBlockSize a = objBits makeObject \<longrightarrow> valid_objs' s \<and> valid_cap' aa s \<and> (\<forall>r\<in>cte_refs' aa (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False (capPtr a) pageBits idx) b s
 3. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s x xb xc a b aa ba xe ab bb ys. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (a, b) # (aa, ba) # xe; cte_wp_at' ((=) a \<circ> cteCap) b s; cte_wp_at' ((=) aa \<circ> cteCap) ba s; \<forall>x\<in>set xe. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s; \<exists>us vs. assocs (armKSASIDTable (ksArchState s)) = us @ (ab, bb) # vs \<and> (\<forall>u\<in>set us. \<not> (fst u \<le> 2 ^ local.asid_high_bits - 1 \<and> snd u = None)) \<and> (fst (ab, bb) \<le> 2 ^ local.asid_high_bits - 1 \<and> snd (ab, bb) = None) \<and> ys = filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) vs\<rbrakk> \<Longrightarrow> ab << local.asid_low_bits < 2 ^ local.asid_bits
 2. \<And>s x xb xc a b aa ba xe. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (a, b) # (aa, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); cte_wp_at' ((=) a \<circ> cteCap) b s; cte_wp_at' ((=) aa \<circ> cteCap) ba s; \<forall>x\<in>set xe. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s\<rbrakk> \<Longrightarrow> (\<exists>d v0 v1 f. a = capability.UntypedCap d v0 v1 f) \<and> \<not> capIsDevice a \<and> capBlockSize a = objBits makeObject \<longrightarrow> valid_objs' s \<and> valid_cap' aa s \<and> (\<forall>r\<in>cte_refs' aa (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False (capPtr a) pageBits idx) b s
 3. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s x xb xc a b aa ba xe ab us vs. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (a, b) # (aa, ba) # xe; cte_wp_at' ((=) a \<circ> cteCap) b s; cte_wp_at' ((=) aa \<circ> cteCap) ba s; \<forall>x\<in>set xe. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s; assocs (armKSASIDTable (ksArchState s)) = us @ (ab, None) # vs; \<forall>u\<in>set us. fst u \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> (\<exists>y. snd u = Some y); ab \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> ab << local.asid_low_bits < 2 ^ local.asid_bits
 2. \<And>s x xb xc a b aa ba xe. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (a, b) # (aa, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); cte_wp_at' ((=) a \<circ> cteCap) b s; cte_wp_at' ((=) aa \<circ> cteCap) ba s; \<forall>x\<in>set xe. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s\<rbrakk> \<Longrightarrow> (\<exists>d v0 v1 f. a = capability.UntypedCap d v0 v1 f) \<and> \<not> capIsDevice a \<and> capBlockSize a = objBits makeObject \<longrightarrow> valid_objs' s \<and> valid_cap' aa s \<and> (\<forall>r\<in>cte_refs' aa (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False (capPtr a) pageBits idx) b s
 3. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>s x xb xc a b aa ba xe ab us vs. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (a, b) # (aa, ba) # xe; cte_wp_at' ((=) a \<circ> cteCap) b s; cte_wp_at' ((=) aa \<circ> cteCap) ba s; \<forall>x\<in>set xe. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s; assocs (armKSASIDTable (ksArchState s)) = us @ (ab, None) # vs; \<forall>u\<in>set us. fst u \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> (\<exists>y. snd u = Some y); ab \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> ab < 2 ^ (local.asid_bits - local.asid_low_bits)
 2. \<And>s x xb xc a b aa ba xe ab us vs. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (a, b) # (aa, ba) # xe; cte_wp_at' ((=) a \<circ> cteCap) b s; cte_wp_at' ((=) aa \<circ> cteCap) ba s; \<forall>x\<in>set xe. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s; assocs (armKSASIDTable (ksArchState s)) = us @ (ab, None) # vs; \<forall>u\<in>set us. fst u \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> (\<exists>y. snd u = Some y); ab \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> local.asid_bits < LENGTH(32)
 3. \<And>s x xb xc a b aa ba xe. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (a, b) # (aa, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); cte_wp_at' ((=) a \<circ> cteCap) b s; cte_wp_at' ((=) aa \<circ> cteCap) ba s; \<forall>x\<in>set xe. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s\<rbrakk> \<Longrightarrow> (\<exists>d v0 v1 f. a = capability.UntypedCap d v0 v1 f) \<and> \<not> capIsDevice a \<and> capBlockSize a = objBits makeObject \<longrightarrow> valid_objs' s \<and> valid_cap' aa s \<and> (\<forall>r\<in>cte_refs' aa (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False (capPtr a) pageBits idx) b s
 4. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 6. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>s x xb xc a b aa ba xe ab us vs. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (a, b) # (aa, ba) # xe; cte_wp_at' ((=) a \<circ> cteCap) b s; cte_wp_at' ((=) aa \<circ> cteCap) ba s; \<forall>x\<in>set xe. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s; assocs (armKSASIDTable (ksArchState s)) = us @ (ab, None) # vs; \<forall>u\<in>set us. fst u \<le> 0x7F \<longrightarrow> (\<exists>y. snd u = Some y); ab \<le> 0x7F\<rbrakk> \<Longrightarrow> ab < 0x80
 2. \<And>s x xb xc a b aa ba xe ab us vs. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (a, b) # (aa, ba) # xe; cte_wp_at' ((=) a \<circ> cteCap) b s; cte_wp_at' ((=) aa \<circ> cteCap) ba s; \<forall>x\<in>set xe. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s; assocs (armKSASIDTable (ksArchState s)) = us @ (ab, None) # vs; \<forall>u\<in>set us. fst u \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> (\<exists>y. snd u = Some y); ab \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> local.asid_bits < LENGTH(32)
 3. \<And>s x xb xc a b aa ba xe. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (a, b) # (aa, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); cte_wp_at' ((=) a \<circ> cteCap) b s; cte_wp_at' ((=) aa \<circ> cteCap) ba s; \<forall>x\<in>set xe. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s\<rbrakk> \<Longrightarrow> (\<exists>d v0 v1 f. a = capability.UntypedCap d v0 v1 f) \<and> \<not> capIsDevice a \<and> capBlockSize a = objBits makeObject \<longrightarrow> valid_objs' s \<and> valid_cap' aa s \<and> (\<forall>r\<in>cte_refs' aa (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False (capPtr a) pageBits idx) b s
 4. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 6. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s x xb xc a b aa ba xe ab us vs. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (a, b) # (aa, ba) # xe; cte_wp_at' ((=) a \<circ> cteCap) b s; cte_wp_at' ((=) aa \<circ> cteCap) ba s; \<forall>x\<in>set xe. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s; assocs (armKSASIDTable (ksArchState s)) = us @ (ab, None) # vs; \<forall>u\<in>set us. fst u \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> (\<exists>y. snd u = Some y); ab \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> local.asid_bits < LENGTH(32)
 2. \<And>s x xb xc a b aa ba xe. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (a, b) # (aa, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); cte_wp_at' ((=) a \<circ> cteCap) b s; cte_wp_at' ((=) aa \<circ> cteCap) ba s; \<forall>x\<in>set xe. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s\<rbrakk> \<Longrightarrow> (\<exists>d v0 v1 f. a = capability.UntypedCap d v0 v1 f) \<and> \<not> capIsDevice a \<and> capBlockSize a = objBits makeObject \<longrightarrow> valid_objs' s \<and> valid_cap' aa s \<and> (\<forall>r\<in>cte_refs' aa (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False (capPtr a) pageBits idx) b s
 3. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s x xb xc a b aa ba xe. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (a, b) # (aa, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); cte_wp_at' ((=) a \<circ> cteCap) b s; cte_wp_at' ((=) aa \<circ> cteCap) ba s; \<forall>x\<in>set xe. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s\<rbrakk> \<Longrightarrow> (\<exists>d v0 v1 f. a = capability.UntypedCap d v0 v1 f) \<and> \<not> capIsDevice a \<and> capBlockSize a = objBits makeObject \<longrightarrow> valid_objs' s \<and> valid_cap' aa s \<and> (\<forall>r\<in>cte_refs' aa (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False (capPtr a) pageBits idx) b s
 2. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s x xb xc b aa ba xe d v0 f. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (capability.UntypedCap False v0 (objBits makeObject) f, b) # (aa, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); cte_wp_at' ((=) (capability.UntypedCap False v0 (objBits makeObject) f) \<circ> cteCap) b s; cte_wp_at' ((=) aa \<circ> cteCap) ba s; \<forall>x\<in>set xe. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s; \<not> d\<rbrakk> \<Longrightarrow> valid_objs' s \<and> valid_cap' aa s \<and> (\<forall>r\<in>cte_refs' aa (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False v0 pageBits idx) b s
 2. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s x xb xc b aa ba xe d v0 f. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; cte_wp_at' ((=) (capability.ArchObjectCap arch_capability.ASIDControlCap) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (capability.UntypedCap False v0 (objBits makeObject) f, b) # (aa, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); cte_wp_at' ((=) (capability.UntypedCap False v0 (objBits makeObject) f) \<circ> cteCap) b s; cte_wp_at' ((=) aa \<circ> cteCap) ba s; \<forall>x\<in>set xe. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s; \<not> d\<rbrakk> \<Longrightarrow> valid_cap' aa s \<and> (\<forall>r\<in>cte_refs' aa (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> cte_wp_at' (\<lambda>cte. \<exists>idx. cteCap cte = capability.UntypedCap False v0 pageBits idx) b s
 2. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s x xb xc b ba xe d v0 f cte ctea cteb. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (cteCap cte) s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (cteCap ctea, b) # (cteCap cteb, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); \<forall>x\<in>set xe. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; \<not> d; ctes_of s slot = Some cte; capability.ArchObjectCap arch_capability.ASIDControlCap = cteCap cte; ctes_of s b = Some ctea; capability.UntypedCap False v0 pageBits f = cteCap ctea; ctes_of s ba = Some cteb\<rbrakk> \<Longrightarrow> valid_cap' (cteCap cteb) s \<and> (\<forall>r\<in>cte_refs' (cteCap cteb) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<exists>idx. cteCap ctea = capability.UntypedCap False v0 pageBits idx)
 2. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s x xb xc b ba xe d v0 f cte ctea cteb. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (cteCap cte) s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (cteCap ctea, b) # (cteCap cteb, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); \<forall>x\<in>set xe. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; \<not> d; ctes_of s slot = Some cte; capability.ArchObjectCap arch_capability.ASIDControlCap = cteCap cte; ctes_of s b = Some ctea; capability.UntypedCap False v0 pageBits f = cteCap ctea; ctes_of s ba = Some cteb\<rbrakk> \<Longrightarrow> valid_cap' (cteCap cteb) s
 2. \<And>s x xb xc b ba xe d v0 f cte ctea cteb. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (cteCap cte) s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (cteCap ctea, b) # (cteCap cteb, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); \<forall>x\<in>set xe. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; \<not> d; ctes_of s slot = Some cte; capability.ArchObjectCap arch_capability.ASIDControlCap = cteCap cte; ctes_of s b = Some ctea; capability.UntypedCap False v0 pageBits f = cteCap ctea; ctes_of s ba = Some cteb\<rbrakk> \<Longrightarrow> (\<forall>r\<in>cte_refs' (cteCap cteb) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<exists>idx. cteCap ctea = capability.UntypedCap False v0 pageBits idx)
 3. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s x xb xc b ba xe d v0 f cte ctea x1 x2. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (cteCap cte) s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (cteCap ctea, b) # (x1, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); \<forall>x\<in>set xe. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; \<not> d; ctes_of s slot = Some cte; capability.ArchObjectCap arch_capability.ASIDControlCap = cteCap cte; ctes_of s b = Some ctea; capability.UntypedCap False v0 pageBits f = cteCap ctea; ctes_of s ba = Some (CTE x1 x2)\<rbrakk> \<Longrightarrow> valid_cap' x1 s
 2. \<And>s x xb xc b ba xe d v0 f cte ctea cteb. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (cteCap cte) s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (cteCap ctea, b) # (cteCap cteb, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); \<forall>x\<in>set xe. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; \<not> d; ctes_of s slot = Some cte; capability.ArchObjectCap arch_capability.ASIDControlCap = cteCap cte; ctes_of s b = Some ctea; capability.UntypedCap False v0 pageBits f = cteCap ctea; ctes_of s ba = Some cteb\<rbrakk> \<Longrightarrow> (\<forall>r\<in>cte_refs' (cteCap cteb) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<exists>idx. cteCap ctea = capability.UntypedCap False v0 pageBits idx)
 3. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>s x xb xc b ba xe d v0 f cte ctea x1 x2. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (cteCap cte) s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (cteCap ctea, b) # (x1, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); \<forall>x\<in>set xe. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; \<not> d; ctes_of s slot = Some cte; capability.ArchObjectCap arch_capability.ASIDControlCap = cteCap cte; ctes_of s b = Some ctea; capability.UntypedCap False v0 pageBits f = cteCap ctea; valid_cap' x1 s\<rbrakk> \<Longrightarrow> valid_cap' x1 s
 2. \<And>s x xb xc b ba xe d v0 f cte ctea cteb. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (cteCap cte) s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (cteCap ctea, b) # (cteCap cteb, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); \<forall>x\<in>set xe. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; \<not> d; ctes_of s slot = Some cte; capability.ArchObjectCap arch_capability.ASIDControlCap = cteCap cte; ctes_of s b = Some ctea; capability.UntypedCap False v0 pageBits f = cteCap ctea; ctes_of s ba = Some cteb\<rbrakk> \<Longrightarrow> (\<forall>r\<in>cte_refs' (cteCap cteb) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<exists>idx. cteCap ctea = capability.UntypedCap False v0 pageBits idx)
 3. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s x xb xc b ba xe d v0 f cte ctea cteb. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (cteCap cte) s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (cteCap ctea, b) # (cteCap cteb, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); \<forall>x\<in>set xe. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; \<not> d; ctes_of s slot = Some cte; capability.ArchObjectCap arch_capability.ASIDControlCap = cteCap cte; ctes_of s b = Some ctea; capability.UntypedCap False v0 pageBits f = cteCap ctea; ctes_of s ba = Some cteb\<rbrakk> \<Longrightarrow> (\<forall>r\<in>cte_refs' (cteCap cteb) (irq_node' s). ex_cte_cap_wp_to' (\<lambda>_. True) r s) \<and> (\<exists>idx. cteCap ctea = capability.UntypedCap False v0 pageBits idx)
 2. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s x xb xc b ba xe d v0 f cte ctea cteb. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (cteCap cte) s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (cteCap ctea, b) # (cteCap cteb, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); \<forall>x\<in>set xe. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; \<not> d; ctes_of s slot = Some cte; capability.ArchObjectCap arch_capability.ASIDControlCap = cteCap cte; ctes_of s b = Some ctea; capability.UntypedCap False v0 pageBits f = cteCap ctea; ctes_of s ba = Some cteb\<rbrakk> \<Longrightarrow> (\<forall>r\<in>cte_refs' (cteCap cteb) (irq_node' s). \<exists>cref cte. ctes_of s cref = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s)) \<and> (\<exists>idx. cteCap ctea = capability.UntypedCap False v0 pageBits idx)
 2. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s x xb xc b ba xe d v0 f cte ctea cteb. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (cteCap cte) s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (capability.UntypedCap False v0 pageBits f, b) # (cteCap cteb, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); \<forall>x\<in>set xe. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; \<not> d; ctes_of s slot = Some cte; capability.ArchObjectCap arch_capability.ASIDControlCap = cteCap cte; ctes_of s b = Some ctea; ctes_of s ba = Some cteb; cteCap ctea = capability.UntypedCap False v0 pageBits f\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs' (cteCap cteb) (irq_node' s). \<exists>cref cte. ctes_of s cref = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s)
 2. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s x xb xc b ba xe d v0 f cte ctea cteb r. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (capability.UntypedCap False v0 pageBits f, b) # (cteCap cteb, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); \<forall>x\<in>set xe. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; \<not> d; ctes_of s slot = Some cte; ctes_of s b = Some ctea; ctes_of s ba = Some cteb; cteCap ctea = capability.UntypedCap False v0 pageBits f; cteCap cte = capability.ArchObjectCap arch_capability.ASIDControlCap; r \<in> cte_refs' (cteCap cteb) (irq_node' s)\<rbrakk> \<Longrightarrow> \<exists>cref cte. ctes_of s cref = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s)
 2. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>s x xb xc b ba xe d v0 f cte ctea cteb r. \<lbrakk>arch_cap = arch_capability.ASIDControlCap; invs' s; valid_cap' (capability.ArchObjectCap arch_capability.ASIDControlCap) s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; args = x # xb # xc; excaps = (capability.UntypedCap False v0 pageBits f, b) # (cteCap cteb, ba) # xe; \<not> null (filter (\<lambda>p. fst p \<le> 2 ^ local.asid_high_bits - 1 \<and> snd p = None) (assocs (armKSASIDTable (ksArchState s)))); \<forall>x\<in>set xe. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; \<not> d; ctes_of s slot = Some cte; ctes_of s b = Some ctea; ctes_of s ba = Some cteb; cteCap ctea = capability.UntypedCap False v0 pageBits f; cteCap cte = capability.ArchObjectCap arch_capability.ASIDControlCap; r \<in> cte_refs' (cteCap cteb) (irq_node' s)\<rbrakk> \<Longrightarrow> \<exists>cte. ctes_of s ba = Some cte \<and> r \<in> cte_refs' (cteCap cte) (irq_node' s)
 2. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 x35. arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label = ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 word vmrights vmpage_size option. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size option)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size option)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 word vmrights vmpage_size option) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 word vmrights vmpage_size option)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 word vmrights vmpage_size option)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 word vmrights vmpage_size option)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 word vmrights vmpage_size option)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 word vmrights vmpage_size option)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 word vmrights vmpage_size option)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 word vmrights vmpage_size option) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 word vmrights vmpage_size option) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 word vmrights vmpage_size option) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 word vmrights vmpage_size option) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 word vmrights vmpage_size option) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 word vmrights vmpage_size option)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 word vmrights vmpage_size option. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size option)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size option)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case args of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | [vaddr] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | [vaddr, rightsMask] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | vaddr # rightsMask # attr # x \<Rightarrow> case excaps of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | ac # xb \<Rightarrow> doE p <- case fst ac of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
y <- case option of None \<Rightarrow> whenE (pptrBase \<le> vaddr + 2 ^ pageBitsForSize vmpage_size - 1) (throwError (Fault_H.syscall_error.InvalidArgument 0)) | Some x2 \<Rightarrow> doE y <- whenE (fst x2 \<noteq> snd p) (throwError (Fault_H.syscall_error.InvalidCapability (Suc 0)));
whenE (snd x2 \<noteq> vaddr) (throwError (Fault_H.syscall_error.InvalidArgument 0))
odE;
pdCheck <- lookupErrorOnFailure False (findPDForASID (snd p));
y <- whenE (pdCheck \<noteq> fst p) (throwError (Fault_H.syscall_error.InvalidCapability (Suc 0)));
y <- checkVPAlignment vmpage_size vaddr;
entries <- createMappingEntries (addrFromPPtr word) vaddr vmpage_size (maskVMRights vmrights (rightsFromWord rightsMask)) (attribsFromWord attr) (fst p);
y <- ensureSafeMapping entries;
returnOk (invocation.InvokePage (ARM_H.PageMap (snd p) (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (snd p, vaddr)))) slot entries))
odE \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>x31 word vmrights vmpage_size option. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>?P'1037 x31 word vmrights vmpage_size option\<rbrace> case args of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | [vaddr] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | [vaddr, rightsMask] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | vaddr # rightsMask # attr # x \<Rightarrow> case excaps of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | ac # xb \<Rightarrow> doE p <- case fst ac of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
y <- case option of None \<Rightarrow> whenE (pptrBase \<le> vaddr + 2 ^ pageBitsForSize vmpage_size - 1) (throwError (Fault_H.syscall_error.InvalidArgument 0)) | Some x2 \<Rightarrow> doE y <- whenE (fst x2 \<noteq> snd p) (throwError (Fault_H.syscall_error.InvalidCapability (Suc 0)));
whenE (snd x2 \<noteq> vaddr) (throwError (Fault_H.syscall_error.InvalidArgument 0))
odE;
pdCheck <- lookupErrorOnFailure False (findPDForASID (snd p));
y <- whenE (pdCheck \<noteq> fst p) (throwError (Fault_H.syscall_error.InvalidCapability (Suc 0)));
y <- checkVPAlignment vmpage_size vaddr;
entries <- createMappingEntries (addrFromPPtr word) vaddr vmpage_size (maskVMRights vmrights (rightsFromWord rightsMask)) (attribsFromWord attr) (fst p);
y <- ensureSafeMapping entries;
returnOk (invocation.InvokePage (ARM_H.PageMap (snd p) (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (snd p, vaddr)))) slot entries))
odE \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x31 word vmrights vmpage_size option s. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; (invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size option)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size option)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> ?P'1037 x31 word vmrights vmpage_size option s
 3. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (11 subgoals):
 1. \<And>x31 word vmrights vmpage_size option x21 x21a x21b x22b a b x22c aa ba pdCheck entries. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; args = x21 # x21a # x21b # x22b; excaps = (a, b) # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?P'1122 aa ba a b x31 word vmrights vmpage_size option x21 (x21a # x21b # x22b) x21a (x21b # x22b) x21b x22b (a, b) x22c (aa, ba) () pdCheck () () entries\<rbrace> ensureSafeMapping entries \<lbrace>\<lambda>yc a. cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (ba, x21))))) slot a \<and> valid_slots' entries a \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (ba, x21)))) a \<and> valid_pde_slots' entries \<and> valid_slots_duplicated' entries a\<rbrace>, -
 2. \<And>x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y pdCheck ya yb. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; args = x21 # x22; x22 = x21a # x22a; x22a = x21b # x22b; excaps = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B1109 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y pdCheck ya yb\<rbrace> createMappingEntries (addrFromPPtr word) x21 vmpage_size (maskVMRights vmrights (rightsFromWord x21a)) (attribsFromWord x21b) (fst p) \<lbrace>\<lambda>entries s. True \<and> ?P'1122 (fst p) (snd p) (fst x21c) (snd x21c) x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y pdCheck ya yb entries s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y pdCheck ya. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; args = x21 # x22; x22 = x21a # x22a; x22a = x21b # x22b; excaps = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B1108 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y pdCheck ya\<rbrace> checkVPAlignment vmpage_size x21 \<lbrace>?B1109 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y pdCheck ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y pdCheck. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; args = x21 # x22; x22 = x21a # x22a; x22a = x21b # x22b; excaps = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B1107 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y pdCheck\<rbrace> whenE (pdCheck \<noteq> fst p) (throwError (Fault_H.syscall_error.InvalidCapability (Suc 0))) \<lbrace>?B1108 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y pdCheck\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; args = x21 # x22; x22 = x21a # x22a; x22a = x21b # x22b; excaps = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B1106 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y\<rbrace> lookupErrorOnFailure False (findPDForASID (snd p)) \<lbrace>?B1107 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; args = x21 # x22; x22 = x21a # x22a; x22a = x21b # x22b; excaps = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B1105 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p\<rbrace> case option of None \<Rightarrow> whenE (pptrBase \<le> x21 + 2 ^ pageBitsForSize vmpage_size - 1) (throwError (Fault_H.syscall_error.InvalidArgument 0)) | Some x2 \<Rightarrow> doE y <- whenE (fst x2 \<noteq> snd p) (throwError (Fault_H.syscall_error.InvalidCapability (Suc 0)));
whenE (snd x2 \<noteq> x21) (throwError (Fault_H.syscall_error.InvalidArgument 0))
odE \<lbrace>?B1106 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; args = x21 # x22; x22 = x21a # x22a; x22a = x21b # x22b; excaps = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?R1099 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c\<rbrace> case fst x21c of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 \<lbrace>?B1105 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x31 word vmrights vmpage_size option s. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; (invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size option)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size option)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (xc = [] \<longrightarrow> True) \<and> (\<forall>xd xe. xc = xd # xe \<longrightarrow> (excaps = [] \<longrightarrow> True) \<and> (\<forall>xf xg. excaps = xf # xg \<longrightarrow> ?R1099 x31 word vmrights vmpage_size option x xa xb xc xd xe xf xg s))))
 9. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 10. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x31 word vmrights vmpage_size option x21 x21a x21b x22b a b x22c aa ba pdCheck entries. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; args = x21 # x21a # x21b # x22b; excaps = (a, b) # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?R1154 x31 word vmrights vmpage_size option x21 a b aa ba (x21a # x21b # x22b) x21a (x21b # x22b) x21b x22b (a, b) x22c (aa, ba) () pdCheck () () entries\<rbrace> ensureSafeMapping entries \<lbrace>\<lambda>rv. valid_slots_duplicated' entries\<rbrace>, -
 2. \<And>x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y pdCheck ya yb. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; args = x21 # x22; x22 = x21a # x22a; x22a = x21b # x22b; excaps = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B1109 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y pdCheck ya yb\<rbrace> createMappingEntries (addrFromPPtr word) x21 vmpage_size (maskVMRights vmrights (rightsFromWord x21a)) (attribsFromWord x21b) (fst p) \<lbrace>\<lambda>entries s. True \<and> cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (snd p, x21))))) slot s \<and> valid_slots' entries s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (snd p, x21)))) s \<and> valid_pde_slots' entries \<and> ?R1154 x31 word vmrights vmpage_size option x21 (fst x21c) (snd x21c) (fst p) (snd p) x22 x21a x22a x21b x22b x21c x22c p y pdCheck ya yb entries s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y pdCheck ya. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; args = x21 # x22; x22 = x21a # x22a; x22a = x21b # x22b; excaps = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B1108 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y pdCheck ya\<rbrace> checkVPAlignment vmpage_size x21 \<lbrace>?B1109 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y pdCheck ya\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y pdCheck. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; args = x21 # x22; x22 = x21a # x22a; x22a = x21b # x22b; excaps = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B1107 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y pdCheck\<rbrace> whenE (pdCheck \<noteq> fst p) (throwError (Fault_H.syscall_error.InvalidCapability (Suc 0))) \<lbrace>?B1108 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y pdCheck\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; args = x21 # x22; x22 = x21a # x22a; x22a = x21b # x22b; excaps = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B1106 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y\<rbrace> lookupErrorOnFailure False (findPDForASID (snd p)) \<lbrace>?B1107 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; args = x21 # x22; x22 = x21a # x22a; x22a = x21b # x22b; excaps = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?B1105 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p\<rbrace> case option of None \<Rightarrow> whenE (pptrBase \<le> x21 + 2 ^ pageBitsForSize vmpage_size - 1) (throwError (Fault_H.syscall_error.InvalidArgument 0)) | Some x2 \<Rightarrow> doE y <- whenE (fst x2 \<noteq> snd p) (throwError (Fault_H.syscall_error.InvalidCapability (Suc 0)));
whenE (snd x2 \<noteq> x21) (throwError (Fault_H.syscall_error.InvalidArgument 0))
odE \<lbrace>?B1106 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c p\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; args = x21 # x22; x22 = x21a # x22a; x22a = x21b # x22b; excaps = x21c # x22c\<rbrakk> \<Longrightarrow> \<lbrace>?R1099 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c\<rbrace> case fst x21c of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 \<lbrace>?B1105 x31 word vmrights vmpage_size option x21 x22 x21a x22a x21b x22b x21c x22c\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x31 word vmrights vmpage_size option s. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; (invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size option)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size option)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> (args = [] \<longrightarrow> True) \<and> (\<forall>x xa. args = x # xa \<longrightarrow> (xa = [] \<longrightarrow> True) \<and> (\<forall>xb xc. xa = xb # xc \<longrightarrow> (xc = [] \<longrightarrow> True) \<and> (\<forall>xd xe. xc = xd # xe \<longrightarrow> (excaps = [] \<longrightarrow> True) \<and> (\<forall>xf xg. excaps = xf # xg \<longrightarrow> ?R1099 x31 word vmrights vmpage_size option x xa xb xc xd xe xf xg s))))
 9. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 10. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
A total of 11 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>x31 word vmrights vmpage_size option s x xb xd xe a b xf. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size option)) s; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size option)) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (a, b) # xf; vmsz_aligned' x vmpage_size; cte_wp_at' ((=) a \<circ> cteCap) b s; \<forall>x\<in>set xf. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s\<rbrakk> \<Longrightarrow> (option = None \<longrightarrow> \<not> pptrBase \<le> x + 2 ^ pageBitsForSize vmpage_size - 1 \<longrightarrow> (\<forall>xa. a = capability.ArchObjectCap xa \<longrightarrow> (\<forall>xb xc. xa = arch_capability.PageDirectoryCap xb xc \<longrightarrow> (\<forall>xa. xc = Some xa \<longrightarrow> cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xa, x))))) slot s \<and> valid_objs' s \<and> vmsz_aligned' (addrFromPPtr word) vmpage_size \<and> word \<noteq> 0 \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xa, x)))) s \<and> is_aligned xb pdBits \<and> x < pptrBase \<and> vmsz_aligned x vmpage_size \<and> valid_objs' s \<and> page_directory_at' (lookup_pd_slot xb x && ~~ mask pdBits) s \<and> is_aligned xb pdBits)))) \<and> (\<forall>xa. a = capability.ArchObjectCap xa \<longrightarrow> (\<forall>xb xc. xa = arch_capability.PageDirectoryCap xb xc \<longrightarrow> (\<forall>xa. xc = Some xa \<longrightarrow> option = Some (xa, x) \<longrightarrow> cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xa, x))))) slot s \<and> valid_objs' s \<and> vmsz_aligned' (addrFromPPtr word) vmpage_size \<and> word \<noteq> 0 \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xa, x)))) s \<and> is_aligned xb pdBits \<and> x < pptrBase \<and> vmsz_aligned x vmpage_size \<and> valid_objs' s \<and> page_directory_at' (lookup_pd_slot xb x && ~~ mask pdBits) s \<and> is_aligned xb pdBits)))
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 word vmrights vmpage_size option s x xb xd xe b xf cte ctea. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; valid_cap' (cteCap cte) s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (cteCap ctea, b) # xf; vmsz_aligned' x vmpage_size; \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; ctes_of s slot = Some cte; capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size option) = cteCap cte; ctes_of s b = Some ctea\<rbrakk> \<Longrightarrow> (option = None \<longrightarrow> x + 2 ^ pageBitsForSize vmpage_size - 1 < pptrBase \<longrightarrow> (\<forall>xa. cteCap ctea = capability.ArchObjectCap xa \<longrightarrow> (\<forall>xb xc. xa = arch_capability.PageDirectoryCap xb xc \<longrightarrow> (\<forall>xa. xc = Some xa \<longrightarrow> is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xa, x)))) cte \<and> vmsz_aligned' (addrFromPPtr word) vmpage_size \<and> word \<noteq> 0 \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xa, x)))) s \<and> is_aligned xb pdBits \<and> x < pptrBase \<and> vmsz_aligned x vmpage_size \<and> page_directory_at' (lookup_pd_slot xb x && ~~ mask pdBits) s \<and> is_aligned xb pdBits)))) \<and> (\<forall>xa. cteCap ctea = capability.ArchObjectCap xa \<longrightarrow> (\<forall>xb xc. xa = arch_capability.PageDirectoryCap xb xc \<longrightarrow> (\<forall>xa. xc = Some xa \<longrightarrow> option = Some (xa, x) \<longrightarrow> is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xa, x)))) cte \<and> vmsz_aligned' (addrFromPPtr word) vmpage_size \<and> word \<noteq> 0 \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xa, x)))) s \<and> is_aligned xb pdBits \<and> x < pptrBase \<and> vmsz_aligned x vmpage_size \<and> page_directory_at' (lookup_pd_slot xb x && ~~ mask pdBits) s \<and> is_aligned xb pdBits)))
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 word vmrights vmpage_size option s x xb xd xe b xf cte ctea. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size option; invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; valid_cap' (cteCap cte) s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (cteCap ctea, b) # xf; vmsz_aligned' x vmpage_size; \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size option) = cteCap cte; valid_cap' (cteCap cte) s; valid_cap' (cteCap ctea) s\<rbrakk> \<Longrightarrow> (option = None \<longrightarrow> x + 2 ^ pageBitsForSize vmpage_size - 1 < pptrBase \<longrightarrow> (\<forall>xa. cteCap ctea = capability.ArchObjectCap xa \<longrightarrow> (\<forall>xb xc. xa = arch_capability.PageDirectoryCap xb xc \<longrightarrow> (\<forall>xa. xc = Some xa \<longrightarrow> is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xa, x)))) cte \<and> vmsz_aligned' (addrFromPPtr word) vmpage_size \<and> word \<noteq> 0 \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xa, x)))) s \<and> is_aligned xb pdBits \<and> x < pptrBase \<and> vmsz_aligned x vmpage_size \<and> page_directory_at' (lookup_pd_slot xb x && ~~ mask pdBits) s \<and> is_aligned xb pdBits)))) \<and> (\<forall>xa. cteCap ctea = capability.ArchObjectCap xa \<longrightarrow> (\<forall>xb xc. xa = arch_capability.PageDirectoryCap xb xc \<longrightarrow> (\<forall>xa. xc = Some xa \<longrightarrow> option = Some (xa, x) \<longrightarrow> is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xa, x)))) cte \<and> vmsz_aligned' (addrFromPPtr word) vmpage_size \<and> word \<noteq> 0 \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xa, x)))) s \<and> is_aligned xb pdBits \<and> x < pptrBase \<and> vmsz_aligned x vmpage_size \<and> page_directory_at' (lookup_pd_slot xb x && ~~ mask pdBits) s \<and> is_aligned xb pdBits)))
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size None; invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; vmsz_aligned' x vmpage_size; \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size None)) s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh))) s; x + 2 ^ pageBitsForSize vmpage_size - 1 < pptrBase; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size None)\<rbrakk> \<Longrightarrow> is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))) cte \<and> vmsz_aligned' (addrFromPPtr word) vmpage_size \<and> word \<noteq> 0 \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))) s \<and> is_aligned xc pdBits \<and> x < pptrBase \<and> vmsz_aligned x vmpage_size \<and> page_directory_at' (lookup_pd_slot xc x && ~~ mask pdBits) s \<and> is_aligned xc pdBits
 2. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)); invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; vmsz_aligned' x vmpage_size; \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))) s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh))) s; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))\<rbrakk> \<Longrightarrow> is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))) cte \<and> vmsz_aligned' (addrFromPPtr word) vmpage_size \<and> word \<noteq> 0 \<and> is_aligned xc pdBits \<and> x < pptrBase \<and> vmsz_aligned x vmpage_size \<and> page_directory_at' (lookup_pd_slot xc x && ~~ mask pdBits) s \<and> is_aligned xc pdBits
 3. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size None; invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; is_aligned x (pageBitsForSize vmpage_size); \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; x + 2 ^ pageBitsForSize vmpage_size - 1 < pptrBase; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size None); is_aligned word (pageBitsForSize vmpage_size); is_aligned xc 14; pageBitsForSize vmpage_size < word_bits; 14 < word_bits; word \<noteq> 0; \<forall>p<2 ^ (pageBitsForSize vmpage_size - 12). typ_at' (if x31 then UserDataDeviceT else UserDataT) (word + p * 0x1000) s; page_directory_at' xc s; 0 < xh; xh < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> is_aligned (addrFromPPtr word) (pageBitsForSize vmpage_size) \<and> x < pptrBase \<and> is_aligned xc pdBits \<and> vmsz_aligned x vmpage_size \<and> page_directory_at' (lookup_pd_slot xc x && ~~ mask pdBits) s
 2. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)); invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; vmsz_aligned' x vmpage_size; \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))) s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh))) s; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))\<rbrakk> \<Longrightarrow> is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))) cte \<and> vmsz_aligned' (addrFromPPtr word) vmpage_size \<and> word \<noteq> 0 \<and> is_aligned xc pdBits \<and> x < pptrBase \<and> vmsz_aligned x vmpage_size \<and> page_directory_at' (lookup_pd_slot xc x && ~~ mask pdBits) s \<and> is_aligned xc pdBits
 3. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size None; invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; is_aligned x (pageBitsForSize vmpage_size); \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; x + 2 ^ pageBitsForSize vmpage_size - 1 < pptrBase; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size None); is_aligned word (pageBitsForSize vmpage_size); is_aligned xc 14; pageBitsForSize vmpage_size < word_bits; 14 < word_bits; word \<noteq> 0; \<forall>p<2 ^ (pageBitsForSize vmpage_size - 12). typ_at' (if x31 then UserDataDeviceT else UserDataT) (word + p * 0x1000) s; page_directory_at' xc s; 0 < xh; xh < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> is_aligned (addrFromPPtr word) (pageBitsForSize vmpage_size)
 2. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size None; invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; is_aligned x (pageBitsForSize vmpage_size); \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; x + 2 ^ pageBitsForSize vmpage_size - 1 < pptrBase; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size None); is_aligned word (pageBitsForSize vmpage_size); is_aligned xc 14; pageBitsForSize vmpage_size < word_bits; 14 < word_bits; word \<noteq> 0; \<forall>p<2 ^ (pageBitsForSize vmpage_size - 12). typ_at' (if x31 then UserDataDeviceT else UserDataT) (word + p * 0x1000) s; page_directory_at' xc s; 0 < xh; xh < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> x < pptrBase \<and> is_aligned xc pdBits \<and> vmsz_aligned x vmpage_size \<and> page_directory_at' (lookup_pd_slot xc x && ~~ mask pdBits) s
 3. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)); invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; vmsz_aligned' x vmpage_size; \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))) s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh))) s; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))\<rbrakk> \<Longrightarrow> is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))) cte \<and> vmsz_aligned' (addrFromPPtr word) vmpage_size \<and> word \<noteq> 0 \<and> is_aligned xc pdBits \<and> x < pptrBase \<and> vmsz_aligned x vmpage_size \<and> page_directory_at' (lookup_pd_slot xc x && ~~ mask pdBits) s \<and> is_aligned xc pdBits
 4. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 6. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size None; invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; is_aligned x (pageBitsForSize vmpage_size); \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; x + 2 ^ pageBitsForSize vmpage_size - 1 < pptrBase; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size None); is_aligned word (pageBitsForSize vmpage_size); is_aligned xc 14; pageBitsForSize vmpage_size < word_bits; 14 < word_bits; word \<noteq> 0; \<forall>p<2 ^ (pageBitsForSize vmpage_size - 12). typ_at' (if x31 then UserDataDeviceT else UserDataT) (word + p * 0x1000) s; page_directory_at' xc s; 0 < xh; xh < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> x < pptrBase \<and> is_aligned xc pdBits \<and> vmsz_aligned x vmpage_size \<and> page_directory_at' (lookup_pd_slot xc x && ~~ mask pdBits) s
 2. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)); invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; vmsz_aligned' x vmpage_size; \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))) s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh))) s; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))\<rbrakk> \<Longrightarrow> is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))) cte \<and> vmsz_aligned' (addrFromPPtr word) vmpage_size \<and> word \<noteq> 0 \<and> is_aligned xc pdBits \<and> x < pptrBase \<and> vmsz_aligned x vmpage_size \<and> page_directory_at' (lookup_pd_slot xc x && ~~ mask pdBits) s \<and> is_aligned xc pdBits
 3. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size None; invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; is_aligned x (pageBitsForSize vmpage_size); \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; x + 2 ^ pageBitsForSize vmpage_size - 1 < pptrBase; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size None); is_aligned word (pageBitsForSize vmpage_size); is_aligned xc 14; pageBitsForSize vmpage_size < word_bits; 14 < word_bits; word \<noteq> 0; \<forall>p<2 ^ (pageBitsForSize vmpage_size - 12). typ_at' (if x31 then UserDataDeviceT else UserDataT) (word + p * 0x1000) s; page_directory_at' xc s; 0 < xh; xh < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> x < pptrBase \<and> is_aligned xc pdBits \<and> page_directory_at' (lookup_pd_slot xc x && ~~ mask pdBits) s
 2. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)); invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; vmsz_aligned' x vmpage_size; \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))) s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh))) s; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))\<rbrakk> \<Longrightarrow> is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))) cte \<and> vmsz_aligned' (addrFromPPtr word) vmpage_size \<and> word \<noteq> 0 \<and> is_aligned xc pdBits \<and> x < pptrBase \<and> vmsz_aligned x vmpage_size \<and> page_directory_at' (lookup_pd_slot xc x && ~~ mask pdBits) s \<and> is_aligned xc pdBits
 3. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size None; invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; is_aligned x (pageBitsForSize vmpage_size); \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; x + 2 ^ pageBitsForSize vmpage_size - 1 < pptrBase; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size None); is_aligned word (pageBitsForSize vmpage_size); is_aligned xc 14; pageBitsForSize vmpage_size < word_bits; 14 < word_bits; word \<noteq> 0; \<forall>p<2 ^ (pageBitsForSize vmpage_size - 12). typ_at' (if x31 then UserDataDeviceT else UserDataT) (word + p * 0x1000) s; page_directory_at' xc s; 0 < xh; xh < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> x < pptrBase
 2. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size None; invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; is_aligned x (pageBitsForSize vmpage_size); \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; x + 2 ^ pageBitsForSize vmpage_size - 1 < pptrBase; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size None); is_aligned word (pageBitsForSize vmpage_size); is_aligned xc 14; pageBitsForSize vmpage_size < word_bits; 14 < word_bits; word \<noteq> 0; \<forall>p<2 ^ (pageBitsForSize vmpage_size - 12). typ_at' (if x31 then UserDataDeviceT else UserDataT) (word + p * 0x1000) s; page_directory_at' xc s; 0 < xh; xh < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> is_aligned xc pdBits \<and> page_directory_at' (lookup_pd_slot xc x && ~~ mask pdBits) s
 3. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)); invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; vmsz_aligned' x vmpage_size; \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))) s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh))) s; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))\<rbrakk> \<Longrightarrow> is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))) cte \<and> vmsz_aligned' (addrFromPPtr word) vmpage_size \<and> word \<noteq> 0 \<and> is_aligned xc pdBits \<and> x < pptrBase \<and> vmsz_aligned x vmpage_size \<and> page_directory_at' (lookup_pd_slot xc x && ~~ mask pdBits) s \<and> is_aligned xc pdBits
 4. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 6. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (6 subgoals):
 1. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size None; invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; is_aligned x (pageBitsForSize vmpage_size); \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size None); is_aligned word (pageBitsForSize vmpage_size); is_aligned xc 14; pageBitsForSize vmpage_size < word_bits; 14 < word_bits; word \<noteq> 0; \<forall>p<2 ^ (pageBitsForSize vmpage_size - 12). typ_at' (if x31 then UserDataDeviceT else UserDataT) (word + p * 0x1000) s; page_directory_at' xc s; 0 < xh; xh < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> x \<le> x + 2 ^ pageBitsForSize vmpage_size - 1
 2. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size None; invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; is_aligned x (pageBitsForSize vmpage_size); \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; x + 2 ^ pageBitsForSize vmpage_size - 1 < pptrBase; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size None); is_aligned word (pageBitsForSize vmpage_size); is_aligned xc 14; pageBitsForSize vmpage_size < word_bits; 14 < word_bits; word \<noteq> 0; \<forall>p<2 ^ (pageBitsForSize vmpage_size - 12). typ_at' (if x31 then UserDataDeviceT else UserDataT) (word + p * 0x1000) s; page_directory_at' xc s; 0 < xh; xh < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> is_aligned xc pdBits \<and> page_directory_at' (lookup_pd_slot xc x && ~~ mask pdBits) s
 3. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)); invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; vmsz_aligned' x vmpage_size; \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))) s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh))) s; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))\<rbrakk> \<Longrightarrow> is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))) cte \<and> vmsz_aligned' (addrFromPPtr word) vmpage_size \<and> word \<noteq> 0 \<and> is_aligned xc pdBits \<and> x < pptrBase \<and> vmsz_aligned x vmpage_size \<and> page_directory_at' (lookup_pd_slot xc x && ~~ mask pdBits) s \<and> is_aligned xc pdBits
 4. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 6. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size None; invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; is_aligned x (pageBitsForSize vmpage_size); \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; x + 2 ^ pageBitsForSize vmpage_size - 1 < pptrBase; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size None); is_aligned word (pageBitsForSize vmpage_size); is_aligned xc 14; pageBitsForSize vmpage_size < word_bits; 14 < word_bits; word \<noteq> 0; \<forall>p<2 ^ (pageBitsForSize vmpage_size - 12). typ_at' (if x31 then UserDataDeviceT else UserDataT) (word + p * 0x1000) s; page_directory_at' xc s; 0 < xh; xh < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> is_aligned xc pdBits \<and> page_directory_at' (lookup_pd_slot xc x && ~~ mask pdBits) s
 2. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)); invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; vmsz_aligned' x vmpage_size; \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))) s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh))) s; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))\<rbrakk> \<Longrightarrow> is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))) cte \<and> vmsz_aligned' (addrFromPPtr word) vmpage_size \<and> word \<noteq> 0 \<and> is_aligned xc pdBits \<and> x < pptrBase \<and> vmsz_aligned x vmpage_size \<and> page_directory_at' (lookup_pd_slot xc x && ~~ mask pdBits) s \<and> is_aligned xc pdBits
 3. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)); invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; vmsz_aligned' x vmpage_size; \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))) s; valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh))) s; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))\<rbrakk> \<Longrightarrow> is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)))) cte \<and> vmsz_aligned' (addrFromPPtr word) vmpage_size \<and> word \<noteq> 0 \<and> is_aligned xc pd_bits \<and> x < pptrBase \<and> vmsz_aligned x vmpage_size \<and> (\<forall>y<0x1000. pde_at' ((lookup_pd_slot xc x && ~~ mask pd_bits) + (y << 2)) s) \<and> is_aligned xc pd_bits
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)); invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; is_aligned x (pageBitsForSize vmpage_size); \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x))); is_aligned word (pageBitsForSize vmpage_size); is_aligned xc 14; pageBitsForSize vmpage_size < word_bits; 14 < word_bits; page_directory_at' xc s; word \<noteq> 0; \<forall>p<2 ^ (pageBitsForSize vmpage_size - 12). typ_at' (if x31 then UserDataDeviceT else UserDataT) (word + p * 0x1000) s; 0 < xh; xh < 2 ^ local.asid_bits; x < pptrBase\<rbrakk> \<Longrightarrow> is_aligned (addrFromPPtr word) (pageBitsForSize vmpage_size) \<and> is_aligned xc pd_bits \<and> vmsz_aligned x vmpage_size \<and> (\<forall>y<0x1000. pde_at' ((lookup_pd_slot xc x && ~~ mask pd_bits) + (y << 2)) s)
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (5 subgoals):
 1. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)); invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; is_aligned x (pageBitsForSize vmpage_size); \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x))); is_aligned word (pageBitsForSize vmpage_size); is_aligned xc 14; pageBitsForSize vmpage_size < word_bits; 14 < word_bits; page_directory_at' xc s; word \<noteq> 0; \<forall>p<2 ^ (pageBitsForSize vmpage_size - 12). typ_at' (if x31 then UserDataDeviceT else UserDataT) (word + p * 0x1000) s; 0 < xh; xh < 2 ^ local.asid_bits; x < pptrBase\<rbrakk> \<Longrightarrow> is_aligned (addrFromPPtr word) (pageBitsForSize vmpage_size)
 2. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)); invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; is_aligned x (pageBitsForSize vmpage_size); \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x))); is_aligned word (pageBitsForSize vmpage_size); is_aligned xc 14; pageBitsForSize vmpage_size < word_bits; 14 < word_bits; page_directory_at' xc s; word \<noteq> 0; \<forall>p<2 ^ (pageBitsForSize vmpage_size - 12). typ_at' (if x31 then UserDataDeviceT else UserDataT) (word + p * 0x1000) s; 0 < xh; xh < 2 ^ local.asid_bits; x < pptrBase\<rbrakk> \<Longrightarrow> is_aligned xc pd_bits \<and> vmsz_aligned x vmpage_size \<and> (\<forall>y<0x1000. pde_at' ((lookup_pd_slot xc x && ~~ mask pd_bits) + (y << 2)) s)
 3. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)); invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; is_aligned x (pageBitsForSize vmpage_size); \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x))); is_aligned word (pageBitsForSize vmpage_size); is_aligned xc 14; pageBitsForSize vmpage_size < word_bits; 14 < word_bits; page_directory_at' xc s; word \<noteq> 0; \<forall>p<2 ^ (pageBitsForSize vmpage_size - 12). typ_at' (if x31 then UserDataDeviceT else UserDataT) (word + p * 0x1000) s; 0 < xh; xh < 2 ^ local.asid_bits; x < pptrBase\<rbrakk> \<Longrightarrow> is_aligned xc pd_bits \<and> vmsz_aligned x vmpage_size \<and> (\<forall>y<0x1000. pde_at' ((lookup_pd_slot xc x && ~~ mask pd_bits) + (y << 2)) s)
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 word vmrights vmpage_size s x xb xd xe b xf cte ctea xc xh. \<lbrakk>arch_cap = arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x)); invocation_type label = ArchInvocationLabel ARMPageMap; invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); args = x # xb # xd # xe; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)), b) # xf; is_aligned x (pageBitsForSize vmpage_size); \<forall>x\<in>set xf. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xc (Some xh)); cteCap cte = capability.ArchObjectCap (arch_capability.PageCap x31 word vmrights vmpage_size (Some (xh, x))); is_aligned word (pageBitsForSize vmpage_size); is_aligned xc 14; pageBitsForSize vmpage_size < word_bits; 14 < word_bits; page_directory_at' xc s; word \<noteq> 0; \<forall>p<2 ^ (pageBitsForSize vmpage_size - 12). typ_at' (if x31 then UserDataDeviceT else UserDataT) (word + p * 0x1000) s; 0 < xh; xh < 2 ^ local.asid_bits; x < pptrBase\<rbrakk> \<Longrightarrow> \<forall>y<0x1000. pde_at' ((lookup_pd_slot xc x && ~~ mask 14) + (y << 2)) s
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label = ArchInvocationLabel ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label = ArchInvocationLabel ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> returnOk (invocation.InvokePage (ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot)) \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35 s. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label = ArchInvocationLabel ARMPageUnmap; (invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> valid_arch_inv' (invocation.InvokePage (ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot)) s
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35 s. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label = ArchInvocationLabel ARMPageUnmap; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot s; \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s)\<rbrakk> \<Longrightarrow> cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35))) slot s
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35 s. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label = ArchInvocationLabel ARMPageUnmap; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s)\<rbrakk> \<Longrightarrow> cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35))) slot s
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35 s c. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label = ArchInvocationLabel ARMPageUnmap; invs' s; valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) c\<rbrakk> \<Longrightarrow> is_arch_update' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) c
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; isPageFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (7 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label = ArchInvocationLabel ARMPageClean_Data\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label = ArchInvocationLabel ARMPageInvalidate_Data\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label = ArchInvocationLabel ARMPageCleanInvalidate_Data\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label = ArchInvocationLabel ARMPageUnify_Instruction\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 6. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 7. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label); invocation_type label = ArchInvocationLabel ARMPageGetAddress\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label); invocation_type label \<noteq> ArchInvocationLabel ARMPageGetAddress\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress); invocation_type label = ArchInvocationLabel ARMPageGetAddress\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> returnOk (invocation.InvokePage (ARM_H.PageGetAddr x32)) \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label); invocation_type label \<noteq> ArchInvocationLabel ARMPageGetAddress\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (4 subgoals):
 1. \<And>x31 x32 x33 x34 x35 s. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress); invocation_type label = ArchInvocationLabel ARMPageGetAddress; (invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> valid_arch_inv' (invocation.InvokePage (ARM_H.PageGetAddr x32)) s
 2. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label); invocation_type label \<noteq> ArchInvocationLabel ARMPageGetAddress\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 4. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 x35. \<lbrakk>arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35; invocation_type label \<noteq> ArchInvocationLabel ARMPageMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap; \<not> isPageFlushLabel (invocation_type label); invocation_type label \<noteq> ArchInvocationLabel ARMPageGetAddress\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageCap x31 x32 x33 x34 x35)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageMap \<Rightarrow> case snd (invocation_type label, args, excaps) of ([], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | ([vaddr, rightsMask], xa) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, []) \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | (vaddr # rightsMask # attr # xb, (pdCap, xa) # xba) \<Rightarrow> doE (pd, asid) <- case pdCap of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
case capVPMappedAddress (arch_capability.PageCap x31 x32 x33 x34 x35) of None \<Rightarrow> doE vtop <- returnOk (vaddr + HaskellLib_H.bit (pageBitsForSize $ capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) - 1);
whenE (pptrBase \<le> VPtr vtop) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
whenE (vaddr' \<noteq> VPtr vaddr) $ throw $ Fault_H.syscall_error.InvalidArgument 0
odE;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 1;
vmRights <- returnOk (maskVMRights (capVPRights (arch_capability.PageCap x31 x32 x33 x34 x35)) $ rightsFromWord rightsMask);
checkVPAlignment (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr);
entries <- createMappingEntries (addrFromPPtr $ capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) (VPtr vaddr) (capVPSize (arch_capability.PageCap x31 x32 x33 x34 x35)) vmRights (attribsFromWord attr) pd;
ensureSafeMapping entries;
returnOk $ invocation.InvokePage $ ARM_H.PageMap asid (capability.ArchObjectCap $ capVPMappedAddress_update (\<lambda>_. Just (asid, VPtr vaddr)) (arch_capability.PageCap x31 x32 x33 x34 x35)) slot entries
odE | ArchInvocationLabel ARMPageUnmap \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageUnmap (arch_capability.PageCap x31 x32 x33 x34 x35) slot | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> decodeARMPageFlush label args (arch_capability.PageCap x31 x32 x33 x34 x35) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> case snd (invocation_type label, args, excaps) of (x, xa) \<Rightarrow> returnOk $ invocation.InvokePage $ ARM_H.PageGetAddr (capVPBasePtr (arch_capability.PageCap x31 x32 x33 x34 x35)) | ArchInvocationLabel _ \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 3. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>x41 x42. arch_cap = arch_capability.PageTableCap x41 x42 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageTableCap x41 x42)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throwError Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageTableMap \<Rightarrow> case args of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | [vaddr] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | vaddr # attr # x \<Rightarrow> case excaps of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | ab # xb \<Rightarrow> doE y <- whenE (\<exists>a b. x42 = Some (a, b)) (throwError (Fault_H.syscall_error.InvalidCapability 0));
p <- case fst ab of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
y <- whenE (pptrBase \<le> vaddr) (throwError (Fault_H.syscall_error.InvalidArgument 0));
pdCheck <- lookupErrorOnFailure False (findPDForASID (snd p));
y <- whenE (pdCheck \<noteq> fst p) (throwError (Fault_H.syscall_error.InvalidCapability (Suc 0)));
oldpde <- liftE (getObject (fst p + (vaddr >> pageBits + ptBits - pteBits << pdeBits)));
y <- unlessE (oldpde = ARM_H.InvalidPDE) (throwError Fault_H.syscall_error.DeleteFirst);
returnOk (invocation.InvokePageTable (ARM_H.PageTableMap (capability.ArchObjectCap (arch_capability.PageTableCap x41 (Some (snd p, vaddr >> pageBits + ptBits - pteBits << pageBits + ptBits - pteBits)))) slot (ARM_H.PageTablePDE (addrFromPPtr x41) (armParityEnabled (attribsFromWord attr)) 0) (fst p + (vaddr >> pageBits + ptBits - pteBits << pdeBits))))
odE | ArchInvocationLabel ARMPageTableUnmap \<Rightarrow> doE cteVal <- liftE (getCTE slot);
final <- liftE (isFinalCapability cteVal);
y <- unlessE final (throwError Fault_H.syscall_error.RevokeFirst);
returnOk (invocation.InvokePageTable (ARM_H.PageTableUnmap (arch_capability.PageTableCap x41 x42) slot))
odE | ArchInvocationLabel _ \<Rightarrow> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>word option. arch_cap = arch_capability.PageTableCap word option \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap word option)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageTableCap word option)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throwError Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageTableMap \<Rightarrow> case args of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | [vaddr] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | vaddr # attr # x \<Rightarrow> case excaps of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | ab # xb \<Rightarrow> doE y <- whenE (\<exists>a b. option = Some (a, b)) (throwError (Fault_H.syscall_error.InvalidCapability 0));
p <- case fst ab of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
y <- whenE (pptrBase \<le> vaddr) (throwError (Fault_H.syscall_error.InvalidArgument 0));
pdCheck <- lookupErrorOnFailure False (findPDForASID (snd p));
y <- whenE (pdCheck \<noteq> fst p) (throwError (Fault_H.syscall_error.InvalidCapability (Suc 0)));
oldpde <- liftE (getObject (fst p + (vaddr >> pageBits + ptBits - pteBits << pdeBits)));
y <- unlessE (oldpde = ARM_H.InvalidPDE) (throwError Fault_H.syscall_error.DeleteFirst);
returnOk (invocation.InvokePageTable (ARM_H.PageTableMap (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (snd p, vaddr >> pageBits + ptBits - pteBits << pageBits + ptBits - pteBits)))) slot (ARM_H.PageTablePDE (addrFromPPtr word) (armParityEnabled (attribsFromWord attr)) 0) (fst p + (vaddr >> pageBits + ptBits - pteBits << pdeBits))))
odE | ArchInvocationLabel ARMPageTableUnmap \<Rightarrow> doE cteVal <- liftE (getCTE slot);
final <- liftE (isFinalCapability cteVal);
y <- unlessE final (throwError Fault_H.syscall_error.RevokeFirst);
returnOk (invocation.InvokePageTable (ARM_H.PageTableUnmap (arch_capability.PageTableCap word option) slot))
odE | ArchInvocationLabel _ \<Rightarrow> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (3 subgoals):
 1. \<And>word option. arch_cap = arch_capability.PageTableCap word option \<Longrightarrow> \<lbrace>?P'2316 word option\<rbrace> case invocation_type label of GenInvocationLabel gen_invocation_labels \<Rightarrow> throwError Fault_H.syscall_error.IllegalOperation | ArchInvocationLabel ARMPageTableMap \<Rightarrow> case args of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | [vaddr] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | vaddr # attr # x \<Rightarrow> case excaps of [] \<Rightarrow> throwError Fault_H.syscall_error.TruncatedMessage | ab # xb \<Rightarrow> doE y <- whenE (\<exists>a b. option = Some (a, b)) (throwError (Fault_H.syscall_error.InvalidCapability 0));
p <- case fst ab of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1;
y <- whenE (pptrBase \<le> vaddr) (throwError (Fault_H.syscall_error.InvalidArgument 0));
pdCheck <- lookupErrorOnFailure False (findPDForASID (snd p));
y <- whenE (pdCheck \<noteq> fst p) (throwError (Fault_H.syscall_error.InvalidCapability (Suc 0)));
oldpde <- liftE (getObject (fst p + (vaddr >> pageBits + ptBits - pteBits << pdeBits)));
y <- unlessE (oldpde = ARM_H.InvalidPDE) (throwError Fault_H.syscall_error.DeleteFirst);
returnOk (invocation.InvokePageTable (ARM_H.PageTableMap (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (snd p, vaddr >> pageBits + ptBits - pteBits << pageBits + ptBits - pteBits)))) slot (ARM_H.PageTablePDE (addrFromPPtr word) (armParityEnabled (attribsFromWord attr)) 0) (fst p + (vaddr >> pageBits + ptBits - pteBits << pdeBits))))
odE | ArchInvocationLabel ARMPageTableUnmap \<Rightarrow> doE cteVal <- liftE (getCTE slot);
final <- liftE (isFinalCapability cteVal);
y <- unlessE final (throwError Fault_H.syscall_error.RevokeFirst);
returnOk (invocation.InvokePageTable (ARM_H.PageTableUnmap (arch_capability.PageTableCap word option) slot))
odE | ArchInvocationLabel _ \<Rightarrow> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>word option s. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; (invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap word option)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageTableCap word option)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))) s\<rbrakk> \<Longrightarrow> ?P'2316 word option s
 3. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (17 subgoals):
 1. \<And>word option x2 x21 x22 x21a x22a x21b x22b p. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; x2 = ARMPageTableMap; args = x21 # x21a # x22a; x22 = x21a # x22a; excaps = x21b # x22b\<rbrakk> \<Longrightarrow> \<lbrace>?P'2472 word option ARMPageTableMap x21 (x21a # x22a) x21a x22a x21b x22b () p ()\<rbrace> findPDForASID (snd p) \<lbrace>\<lambda>a b. ko_at' ARM_H.InvalidPDE (a + (x21 >> pageBits + ptBits - pteBits << pdeBits)) b \<longrightarrow> cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (snd p, x21 >> pageBits + ptBits - pteBits << pageBits + ptBits - pteBits))))) slot b \<and> ko_wp_at' (\<lambda>ko. vs_entry_align ko = 0) (a + (x21 >> pageBits + ptBits - pteBits << pdeBits)) b \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (snd p, x21 >> pageBits + ptBits - pteBits << pageBits + ptBits - pteBits)))) b \<and> is_aligned (addrFromPPtr word) ptBits \<and> valid_pde_mapping_offset' (a + (x21 >> pageBits + ptBits - pteBits << pdeBits) && mask pdBits) \<and> vs_entry_align (KOArch (KOPDE (ARM_H.PageTablePDE (addrFromPPtr word) (armParityEnabled (attribsFromWord x21a)) 0))) = 0\<rbrace>, -
 2. \<And>word option x2 x21 x22 x21a x22a x21b x22b y p. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageTableMap; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b\<rbrakk> \<Longrightarrow> \<lbrace>?B2451 word option x2 x21 x22 x21a x22a x21b x22b y p\<rbrace> whenE (pptrBase \<le> x21) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>ya s. True \<and> ?P'2472 word option x2 x21 x22 x21a x22a x21b x22b y p ya s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>word option x2 x21 x22 x21a x22a x21b x22b y. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageTableMap; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b\<rbrakk> \<Longrightarrow> \<lbrace>?B2450 word option x2 x21 x22 x21a x22a x21b x22b y\<rbrace> case fst x21b of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 \<lbrace>?B2451 word option x2 x21 x22 x21a x22a x21b x22b y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>word option x2 x21 x22 x21a x22a x21b x22b. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageTableMap; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b\<rbrakk> \<Longrightarrow> \<lbrace>?R2443 word option x2 x21 x22 x21a x22a x21b x22b\<rbrace> whenE (\<exists>a b. option = Some (a, b)) (throwError (Fault_H.syscall_error.InvalidCapability 0)) \<lbrace>?B2450 word option x2 x21 x22 x21a x22a x21b x22b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?R2363 word option x2\<rbrace> doE cteVal <- liftE (getCTE slot);
final <- liftE (isFinalCapability cteVal);
y <- unlessE final (throwError Fault_H.syscall_error.RevokeFirst);
returnOk (invocation.InvokePageTable (ARM_H.PageTableUnmap (arch_capability.PageTableCap word option) slot))
odE \<lbrace>valid_arch_inv'\<rbrace>, -
 6. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>?R2362 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 7. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?R2361 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 8. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageClean_Data\<rbrakk> \<Longrightarrow> \<lbrace>?R2360 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 9. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageInvalidate_Data\<rbrakk> \<Longrightarrow> \<lbrace>?R2359 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 10. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageCleanInvalidate_Data\<rbrakk> \<Longrightarrow> \<lbrace>?R2358 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>word option x2 x21 x22 x21a x22a x21b x22b p. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; x2 = ARMPageTableMap; args = x21 # x21a # x22a; x22 = x21a # x22a; excaps = x21b # x22b\<rbrakk> \<Longrightarrow> \<lbrace>?P'2472 word option ARMPageTableMap x21 (x21a # x22a) x21a x22a x21b x22b () p ()\<rbrace> findPDForASID (snd p) \<lbrace>\<lambda>b c. ko_at' ARM_H.InvalidPDE (b + (hd args >> 20 << 2)) c \<longrightarrow> cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (snd p, hd args >> 20 << 20))))) slot c \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (snd p, hd args >> 20 << 20)))) c \<and> is_aligned (addrFromPPtr word) ptBits \<and> valid_pde_mapping_offset' (b + (hd args >> 20 << 2) && mask pdBits)\<rbrace>, -
 2. \<And>word option x2 x21 x22 x21a x22a x21b x22b p rv s. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; x2 = ARMPageTableMap; args = x21 # x21a # x22a; x22 = x21a # x22a; excaps = x21b # x22b; ko_at' ARM_H.InvalidPDE (rv + (hd args >> 20 << 2)) s \<longrightarrow> cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (snd p, hd args >> 20 << 20))))) slot s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (snd p, hd args >> 20 << 20)))) s \<and> is_aligned (addrFromPPtr word) ptBits \<and> valid_pde_mapping_offset' (rv + (hd args >> 20 << 2) && mask pdBits)\<rbrakk> \<Longrightarrow> ko_at' ARM_H.InvalidPDE (rv + (x21 >> pageBits + ptBits - pteBits << pdeBits)) s \<longrightarrow> cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (snd p, x21 >> pageBits + ptBits - pteBits << pageBits + ptBits - pteBits))))) slot s \<and> ko_wp_at' (\<lambda>ko. vs_entry_align ko = 0) (rv + (x21 >> pageBits + ptBits - pteBits << pdeBits)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (snd p, x21 >> pageBits + ptBits - pteBits << pageBits + ptBits - pteBits)))) s \<and> is_aligned (addrFromPPtr word) ptBits \<and> valid_pde_mapping_offset' (rv + (x21 >> pageBits + ptBits - pteBits << pdeBits) && mask pdBits) \<and> vs_entry_align (KOArch (KOPDE (ARM_H.PageTablePDE (addrFromPPtr word) (armParityEnabled (attribsFromWord x21a)) 0))) = 0
 3. \<And>word option x2 x21 x22 x21a x22a x21b x22b y p. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageTableMap; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b\<rbrakk> \<Longrightarrow> \<lbrace>?B2451 word option x2 x21 x22 x21a x22a x21b x22b y p\<rbrace> whenE (pptrBase \<le> x21) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>ya s. True \<and> ?P'2472 word option x2 x21 x22 x21a x22a x21b x22b y p ya s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>word option x2 x21 x22 x21a x22a x21b x22b y. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageTableMap; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b\<rbrakk> \<Longrightarrow> \<lbrace>?B2450 word option x2 x21 x22 x21a x22a x21b x22b y\<rbrace> case fst x21b of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 \<lbrace>?B2451 word option x2 x21 x22 x21a x22a x21b x22b y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>word option x2 x21 x22 x21a x22a x21b x22b. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageTableMap; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b\<rbrakk> \<Longrightarrow> \<lbrace>?R2443 word option x2 x21 x22 x21a x22a x21b x22b\<rbrace> whenE (\<exists>a b. option = Some (a, b)) (throwError (Fault_H.syscall_error.InvalidCapability 0)) \<lbrace>?B2450 word option x2 x21 x22 x21a x22a x21b x22b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?R2363 word option x2\<rbrace> doE cteVal <- liftE (getCTE slot);
final <- liftE (isFinalCapability cteVal);
y <- unlessE final (throwError Fault_H.syscall_error.RevokeFirst);
returnOk (invocation.InvokePageTable (ARM_H.PageTableUnmap (arch_capability.PageTableCap word option) slot))
odE \<lbrace>valid_arch_inv'\<rbrace>, -
 7. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>?R2362 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 8. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?R2361 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 9. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageClean_Data\<rbrakk> \<Longrightarrow> \<lbrace>?R2360 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 10. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageInvalidate_Data\<rbrakk> \<Longrightarrow> \<lbrace>?R2359 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>word option x2 x21 x22 x21a x22a x21b x22b p rv s. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; x2 = ARMPageTableMap; args = x21 # x21a # x22a; x22 = x21a # x22a; excaps = x21b # x22b; ko_at' ARM_H.InvalidPDE (rv + (x21 >> 20 << 2)) s \<longrightarrow> cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (snd p, x21 >> 20 << 20))))) slot s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (snd p, x21 >> 20 << 20)))) s \<and> is_aligned (addrFromPPtr word) ptBits \<and> valid_pde_mapping_offset' (rv + (x21 >> 20 << 2) && mask pdBits)\<rbrakk> \<Longrightarrow> ko_at' ARM_H.InvalidPDE (rv + (x21 >> pageBits + ptBits - pteBits << pdeBits)) s \<longrightarrow> cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (snd p, x21 >> pageBits + ptBits - pteBits << pageBits + ptBits - pteBits))))) slot s \<and> ko_wp_at' (\<lambda>ko. vs_entry_align ko = 0) (rv + (x21 >> pageBits + ptBits - pteBits << pdeBits)) s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (snd p, x21 >> pageBits + ptBits - pteBits << pageBits + ptBits - pteBits)))) s \<and> is_aligned (addrFromPPtr word) ptBits \<and> valid_pde_mapping_offset' (rv + (x21 >> pageBits + ptBits - pteBits << pdeBits) && mask pdBits) \<and> vs_entry_align (KOArch (KOPDE (ARM_H.PageTablePDE (addrFromPPtr word) (armParityEnabled (attribsFromWord x21a)) 0))) = 0
 2. \<And>word option x2 x21 x22 x21a x22a x21b x22b y p. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageTableMap; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b\<rbrakk> \<Longrightarrow> \<lbrace>?B2451 word option x2 x21 x22 x21a x22a x21b x22b y p\<rbrace> whenE (pptrBase \<le> x21) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>ya s. True \<and> cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (snd p, x21 >> 20 << 20))))) slot s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (snd p, x21 >> 20 << 20)))) s \<and> is_aligned (addrFromPPtr word) ptBits \<and> (valid_objs' and K (x21 < pptrBase)) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>word option x2 x21 x22 x21a x22a x21b x22b y. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageTableMap; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b\<rbrakk> \<Longrightarrow> \<lbrace>?B2450 word option x2 x21 x22 x21a x22a x21b x22b y\<rbrace> case fst x21b of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 \<lbrace>?B2451 word option x2 x21 x22 x21a x22a x21b x22b y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>word option x2 x21 x22 x21a x22a x21b x22b. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageTableMap; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b\<rbrakk> \<Longrightarrow> \<lbrace>?R2443 word option x2 x21 x22 x21a x22a x21b x22b\<rbrace> whenE (\<exists>a b. option = Some (a, b)) (throwError (Fault_H.syscall_error.InvalidCapability 0)) \<lbrace>?B2450 word option x2 x21 x22 x21a x22a x21b x22b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?R2363 word option x2\<rbrace> doE cteVal <- liftE (getCTE slot);
final <- liftE (isFinalCapability cteVal);
y <- unlessE final (throwError Fault_H.syscall_error.RevokeFirst);
returnOk (invocation.InvokePageTable (ARM_H.PageTableUnmap (arch_capability.PageTableCap word option) slot))
odE \<lbrace>valid_arch_inv'\<rbrace>, -
 6. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>?R2362 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 7. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?R2361 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 8. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageClean_Data\<rbrakk> \<Longrightarrow> \<lbrace>?R2360 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 9. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageInvalidate_Data\<rbrakk> \<Longrightarrow> \<lbrace>?R2359 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 10. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageCleanInvalidate_Data\<rbrakk> \<Longrightarrow> \<lbrace>?R2358 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>word option x21 x21a x22a a b x22b ba rv s ko. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel ARMPageTableMap; args = x21 # x21a # x22a; excaps = (a, b) # x22b; (\<exists>ko. ksPSpace s (rv + (x21 >> 20 << 2)) = Some ko \<and> is_aligned (rv + (x21 >> 20 << 2)) (objBitsKO ko) \<and> projectKO_opt ko = Some ARM_H.InvalidPDE \<and> ps_clear (rv + (x21 >> 20 << 2)) (objBitsKO ko) s) \<longrightarrow> cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (ba, x21 >> 20 << 20))))) slot s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (ba, x21 >> 20 << 20)))) s \<and> is_aligned (addrFromPPtr word) ptBits \<and> valid_pde_mapping_offset' (rv + (x21 >> 20 << 2) && mask pdBits); ksPSpace s (rv + (x21 >> pageBits + ptBits - pteBits << pdeBits)) = Some ko; is_aligned (rv + (x21 >> pageBits + ptBits - pteBits << pdeBits)) (objBitsKO ko); projectKO_opt ko = Some ARM_H.InvalidPDE; ps_clear (rv + (x21 >> pageBits + ptBits - pteBits << pdeBits)) (objBitsKO ko) s\<rbrakk> \<Longrightarrow> cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (ba, x21 >> pageBits + ptBits - pteBits << pageBits + ptBits - pteBits))))) slot s \<and> vs_entry_align ko = 0 \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (ba, x21 >> pageBits + ptBits - pteBits << pageBits + ptBits - pteBits)))) s \<and> is_aligned (addrFromPPtr word) ptBits \<and> valid_pde_mapping_offset' (rv + (x21 >> pageBits + ptBits - pteBits << pdeBits) && mask pdBits) \<and> vs_entry_align (KOArch (KOPDE (ARM_H.PageTablePDE (addrFromPPtr word) (armParityEnabled (attribsFromWord x21a)) 0))) = 0
 2. \<And>word option x2 x21 x22 x21a x22a x21b x22b y p. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageTableMap; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b\<rbrakk> \<Longrightarrow> \<lbrace>?B2451 word option x2 x21 x22 x21a x22a x21b x22b y p\<rbrace> whenE (pptrBase \<le> x21) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>ya s. True \<and> cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (snd p, x21 >> 20 << 20))))) slot s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (snd p, x21 >> 20 << 20)))) s \<and> is_aligned (addrFromPPtr word) ptBits \<and> (valid_objs' and K (x21 < pptrBase)) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>word option x2 x21 x22 x21a x22a x21b x22b y. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageTableMap; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b\<rbrakk> \<Longrightarrow> \<lbrace>?B2450 word option x2 x21 x22 x21a x22a x21b x22b y\<rbrace> case fst x21b of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 \<lbrace>?B2451 word option x2 x21 x22 x21a x22a x21b x22b y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>word option x2 x21 x22 x21a x22a x21b x22b. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageTableMap; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b\<rbrakk> \<Longrightarrow> \<lbrace>?R2443 word option x2 x21 x22 x21a x22a x21b x22b\<rbrace> whenE (\<exists>a b. option = Some (a, b)) (throwError (Fault_H.syscall_error.InvalidCapability 0)) \<lbrace>?B2450 word option x2 x21 x22 x21a x22a x21b x22b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?R2363 word option x2\<rbrace> doE cteVal <- liftE (getCTE slot);
final <- liftE (isFinalCapability cteVal);
y <- unlessE final (throwError Fault_H.syscall_error.RevokeFirst);
returnOk (invocation.InvokePageTable (ARM_H.PageTableUnmap (arch_capability.PageTableCap word option) slot))
odE \<lbrace>valid_arch_inv'\<rbrace>, -
 6. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>?R2362 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 7. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?R2361 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 8. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageClean_Data\<rbrakk> \<Longrightarrow> \<lbrace>?R2360 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 9. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageInvalidate_Data\<rbrakk> \<Longrightarrow> \<lbrace>?R2359 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 10. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageCleanInvalidate_Data\<rbrakk> \<Longrightarrow> \<lbrace>?R2358 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>word option x2 x21 x22 x21a x22a x21b x22b y p. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageTableMap; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b\<rbrakk> \<Longrightarrow> \<lbrace>?B2451 word option x2 x21 x22 x21a x22a x21b x22b y p\<rbrace> whenE (pptrBase \<le> x21) (throwError (Fault_H.syscall_error.InvalidArgument 0)) \<lbrace>\<lambda>ya s. True \<and> cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (snd p, x21 >> 20 << 20))))) slot s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (snd p, x21 >> 20 << 20)))) s \<and> is_aligned (addrFromPPtr word) ptBits \<and> (valid_objs' and K (x21 < pptrBase)) s\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>word option x2 x21 x22 x21a x22a x21b x22b y. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageTableMap; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b\<rbrakk> \<Longrightarrow> \<lbrace>?B2450 word option x2 x21 x22 x21a x22a x21b x22b y\<rbrace> case fst x21b of capability.ArchObjectCap (arch_capability.PageDirectoryCap pd None) \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | capability.ArchObjectCap (arch_capability.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | capability.ArchObjectCap _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 1 \<lbrace>?B2451 word option x2 x21 x22 x21a x22a x21b x22b y\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>word option x2 x21 x22 x21a x22a x21b x22b. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageTableMap; args = x21 # x22; x22 = x21a # x22a; excaps = x21b # x22b\<rbrakk> \<Longrightarrow> \<lbrace>?R2443 word option x2 x21 x22 x21a x22a x21b x22b\<rbrace> whenE (\<exists>a b. option = Some (a, b)) (throwError (Fault_H.syscall_error.InvalidCapability 0)) \<lbrace>?B2450 word option x2 x21 x22 x21a x22a x21b x22b\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?R2363 word option x2\<rbrace> doE cteVal <- liftE (getCTE slot);
final <- liftE (isFinalCapability cteVal);
y <- unlessE final (throwError Fault_H.syscall_error.RevokeFirst);
returnOk (invocation.InvokePageTable (ARM_H.PageTableUnmap (arch_capability.PageTableCap word option) slot))
odE \<lbrace>valid_arch_inv'\<rbrace>, -
 5. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageMap\<rbrakk> \<Longrightarrow> \<lbrace>?R2362 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 6. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?R2361 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 7. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageClean_Data\<rbrakk> \<Longrightarrow> \<lbrace>?R2360 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 8. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageInvalidate_Data\<rbrakk> \<Longrightarrow> \<lbrace>?R2359 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 9. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageCleanInvalidate_Data\<rbrakk> \<Longrightarrow> \<lbrace>?R2358 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
 10. \<And>word option x2. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invocation_type label = ArchInvocationLabel x2; x2 = ARMPageUnify_Instruction\<rbrakk> \<Longrightarrow> \<lbrace>?R2357 word option x2\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, -
A total of 16 subgoals... proof (prove)
goal (2 subgoals):
 1. \<And>word option s. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invs' s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap word option)) s \<and> cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageTableCap word option)) \<circ> cteCap) slot s \<and> (\<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) \<and> sch_act_simple s \<and> vs_valid_duplicates' (ksPSpace s)\<rbrakk> \<Longrightarrow> \<forall>x. invocation_type label = ArchInvocationLabel x \<longrightarrow> (x = ARMPageTableMap \<longrightarrow> (\<forall>x xa. args = x # xa \<longrightarrow> (\<exists>x xb. xa = x # xb) \<longrightarrow> (\<forall>a. (\<exists>b x. excaps = (a, b) # x) \<longrightarrow> option = None \<longrightarrow> (\<forall>xa. a = capability.ArchObjectCap xa \<longrightarrow> (\<forall>xb xc. xa = arch_capability.PageDirectoryCap xb xc \<longrightarrow> (\<forall>xa. xc = Some xa \<longrightarrow> \<not> pptrBase \<le> x \<longrightarrow> cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (xa, x >> 20 << 20))))) slot s \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (xa, x >> 20 << 20)))) s \<and> is_aligned (addrFromPPtr word) ptBits \<and> valid_objs' s \<and> x < pptrBase)))))) \<and> (x = ARMPageTableUnmap \<longrightarrow> cte_wp_at' (is_arch_update' (capability.ArchObjectCap (arch_capability.PageTableCap word option))) slot s \<and> isPageTableCap (arch_capability.PageTableCap word option))
 2. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>word option s x cte. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invs' s; valid_cap' (cteCap cte) s; \<forall>x\<in>set excaps. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; ctes_of s slot = Some cte; capability.ArchObjectCap (arch_capability.PageTableCap word option) = cteCap cte; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel x\<rbrakk> \<Longrightarrow> (x = ARMPageTableMap \<longrightarrow> (\<forall>x xa. args = x # xa \<longrightarrow> (\<exists>x xb. xa = x # xb) \<longrightarrow> (\<forall>a. (\<exists>b x. excaps = (a, b) # x) \<longrightarrow> option = None \<longrightarrow> (\<forall>xa. a = capability.ArchObjectCap xa \<longrightarrow> (\<forall>xb xc. xa = arch_capability.PageDirectoryCap xb xc \<longrightarrow> (\<forall>xa. xc = Some xa \<longrightarrow> x < pptrBase \<longrightarrow> is_arch_update' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (xa, x >> 20 << 20)))) cte \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (xa, x >> 20 << 20)))) s \<and> is_aligned (addrFromPPtr word) ptBits \<and> valid_objs' s)))))) \<and> (x = ARMPageTableUnmap \<longrightarrow> is_arch_update' (cteCap cte) cte)
 2. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>word option s x cte. \<lbrakk>arch_cap = arch_capability.PageTableCap word option; invs' s; valid_cap' (cteCap cte) s; \<forall>x\<in>set excaps. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; ctes_of s slot = Some cte; capability.ArchObjectCap (arch_capability.PageTableCap word option) = cteCap cte; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel x; is_arch_update' (capability.ArchObjectCap (arch_capability.PageTableCap word option)) cte\<rbrakk> \<Longrightarrow> (x = ARMPageTableMap \<longrightarrow> (\<forall>x xa. args = x # xa \<longrightarrow> (\<exists>x xb. xa = x # xb) \<longrightarrow> (\<forall>a. (\<exists>b x. excaps = (a, b) # x) \<longrightarrow> option = None \<longrightarrow> (\<forall>xa. a = capability.ArchObjectCap xa \<longrightarrow> (\<forall>xb xc. xa = arch_capability.PageDirectoryCap xb xc \<longrightarrow> (\<forall>xa. xc = Some xa \<longrightarrow> x < pptrBase \<longrightarrow> is_arch_update' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (xa, x >> 20 << 20)))) cte \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (xa, x >> 20 << 20)))) s \<and> is_aligned (addrFromPPtr word) ptBits \<and> valid_objs' s)))))) \<and> (x = ARMPageTableUnmap \<longrightarrow> is_arch_update' (cteCap cte) cte)
 2. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>word s cte xa xc xd b xe xg xi ctea. \<lbrakk>arch_cap = arch_capability.PageTableCap word None; invs' s; valid_cap' (cteCap cte) s; ctes_of s slot = Some cte; capability.ArchObjectCap (arch_capability.PageTableCap word None) = cteCap cte; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMPageTableMap; is_arch_update' (cteCap cte) cte; args = xa # xc # xd; excaps = (cteCap ctea, b) # xe; xa < pptrBase; \<forall>x\<in>set xe. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; ctes_of s b = Some ctea; capability.ArchObjectCap (arch_capability.PageDirectoryCap xg (Some xi)) = cteCap ctea\<rbrakk> \<Longrightarrow> is_arch_update' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (xi, xa >> 20 << 20)))) cte \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (xi, xa >> 20 << 20)))) s \<and> is_aligned (addrFromPPtr word) ptBits \<and> valid_objs' s
 2. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>word s cte xa xc xd b xe xg xi ctea. \<lbrakk>arch_cap = arch_capability.PageTableCap word None; invs' s; valid_cap' (cteCap cte) s; ctes_of s slot = Some cte; capability.ArchObjectCap (arch_capability.PageTableCap word None) = cteCap cte; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMPageTableMap; is_arch_update' (cteCap cte) cte; args = xa # xc # xd; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xg (Some xi)), b) # xe; xa < pptrBase; \<forall>x\<in>set xe. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; ctes_of s b = Some ctea; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xg (Some xi))\<rbrakk> \<Longrightarrow> is_arch_update' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (xi, xa >> 20 << 20)))) cte \<and> valid_cap' (capability.ArchObjectCap (arch_capability.PageTableCap word (Some (xi, xa >> 20 << 20)))) s \<and> is_aligned (addrFromPPtr word) ptBits \<and> valid_objs' s
 2. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>word s cte xa xc xd b xe xg xi ctea. \<lbrakk>invs' s; ctes_of s slot = Some cte; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMPageTableMap; args = xa # xc # xd; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xg (Some xi)), b) # xe; xa < pptrBase; \<forall>x\<in>set xe. \<exists>cte. ctes_of s (snd x) = Some cte \<and> fst x = cteCap cte; ctes_of s b = Some ctea; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xg (Some xi)); cteCap cte = capability.ArchObjectCap (arch_capability.PageTableCap word None); is_aligned word 10; 10 < word_bits; page_table_at' word s; arch_cap = arch_capability.PageTableCap word None\<rbrakk> \<Longrightarrow> 0 < xi \<and> xi < 2 ^ local.asid_bits \<and> xa >> 20 << 20 < pptrBase \<and> is_aligned (addrFromPPtr word) ptBits \<and> valid_objs' s
 2. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>word s cte xa xc xd b xe xg xi ctea. \<lbrakk>invs' s; ctes_of s slot = Some cte; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMPageTableMap; args = xa # xc # xd; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xg (Some xi)), b) # xe; xa < pptrBase; ctes_of s b = Some ctea; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xg (Some xi)); cteCap cte = capability.ArchObjectCap (arch_capability.PageTableCap word None); is_aligned word 10; 10 < word_bits; page_table_at' word s; arch_cap = arch_capability.PageTableCap word None\<rbrakk> \<Longrightarrow> 0 < xi \<and> xi < 2 ^ local.asid_bits \<and> xa >> 20 << 20 < pptrBase \<and> is_aligned (addrFromPPtr word) ptBits \<and> valid_objs' s
 2. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>word s cte xa xc xd b xe xg xi ctea. \<lbrakk>invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMPageTableMap; args = xa # xc # xd; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xg (Some xi)), b) # xe; xa < pptrBase; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xg (Some xi)); cteCap cte = capability.ArchObjectCap (arch_capability.PageTableCap word None); is_aligned word 10; 10 < word_bits; page_table_at' word s; arch_cap = arch_capability.PageTableCap word None; valid_cap' (cteCap cte) s; valid_cap' (cteCap ctea) s\<rbrakk> \<Longrightarrow> 0 < xi \<and> xi < 2 ^ local.asid_bits \<and> xa >> 20 << 20 < pptrBase \<and> is_aligned (addrFromPPtr word) ptBits \<and> valid_objs' s
 2. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>word s cte xa xc xd b xe xg xi ctea. \<lbrakk>invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMPageTableMap; args = xa # xc # xd; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xg (Some xi)), b) # xe; xa < pptrBase; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xg (Some xi)); cteCap cte = capability.ArchObjectCap (arch_capability.PageTableCap word None); is_aligned word 10; 10 < word_bits; page_table_at' word s; arch_cap = arch_capability.PageTableCap word None; capAligned (capability.ArchObjectCap (arch_capability.PageTableCap word None)); capAligned (capability.ArchObjectCap (arch_capability.PageDirectoryCap xg (Some xi))); page_directory_at' xg s; 0 < xi; xi < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> xa && ~~ mask 20 < pptrBase
 2. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>word s cte xa xc xd b xe xg xi ctea. \<lbrakk>invs' s; sch_act_simple s; vs_valid_duplicates' (ksPSpace s); invocation_type label = ArchInvocationLabel ARMPageTableMap; args = xa # xc # xd; excaps = (capability.ArchObjectCap (arch_capability.PageDirectoryCap xg (Some xi)), b) # xe; cteCap ctea = capability.ArchObjectCap (arch_capability.PageDirectoryCap xg (Some xi)); cteCap cte = capability.ArchObjectCap (arch_capability.PageTableCap word None); is_aligned word 10; 10 < word_bits; page_table_at' word s; arch_cap = arch_capability.PageTableCap word None; capAligned (capability.ArchObjectCap (arch_capability.PageTableCap word None)); capAligned (capability.ArchObjectCap (arch_capability.PageDirectoryCap xg (Some xi))); page_directory_at' xg s; 0 < xi; xi < 2 ^ local.asid_bits\<rbrakk> \<Longrightarrow> xa && ~~ mask 20 \<le> xa
 2. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap arch_cap) and cte_wp_at' ((=) (capability.ArchObjectCap arch_cap) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot arch_cap excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> Arch.decodeInvocation label args cap_index slot (arch_capability.PageDirectoryCap x51 x52) excaps \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>x51 x52. arch_cap = arch_capability.PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case isPDFlushLabel (invocation_type label) of True \<Rightarrow> case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [start] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | start # end # xa \<Rightarrow> doE whenE (end \<le> start) $ throw $ Fault_H.syscall_error.InvalidArgument 1;
whenE (pptrBase \<le> VPtr start \<or> pptrBase < VPtr end) $ throw Fault_H.syscall_error.IllegalOperation;
(pd, asid) <- case arch_capability.PageDirectoryCap x51 x52 of arch_capability.PageDirectoryCap pd None \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | arch_capability.PageDirectoryCap pd (Some asid) \<Rightarrow> returnOk (pd, asid) | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 0;
(withoutFailure $ resolveVAddr (capPDBasePtr (arch_capability.PageDirectoryCap x51 x52)) (VPtr start)) >>=E case_option (returnOk $ invocation.InvokePageDirectory ARM_H.PageDirectoryNothing) (\<lambda>frameInfo. doE withoutFailure $ checkValidMappingSize (fst frameInfo);
baseStart <- returnOk (pageBase (VPtr start) (fst frameInfo));
baseEnd <- returnOk (pageBase (VPtr end - 1) (fst frameInfo));
whenE (baseStart \<noteq> baseEnd) $ throw $ Fault_H.syscall_error.RangeError start $ fromVPtr $ baseStart + mask (pageBitsForSize (fst frameInfo));
offset <- returnOk (start && mask (pageBitsForSize (fst frameInfo)));
pStart <- returnOk (snd frameInfo + id offset);
returnOk $ invocation.InvokePageDirectory $ ARM_H.PageDirectoryFlush (labelToFlushType label) (VPtr start) (VPtr end - 1) pStart pd asid
odE)
odE | False \<Rightarrow> throw Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>x51 x52. \<lbrakk>arch_cap = arch_capability.PageDirectoryCap x51 x52; isPDFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> case args of [] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | [start] \<Rightarrow> throw Fault_H.syscall_error.TruncatedMessage | start # end # xa \<Rightarrow> doE whenE (end \<le> start) $ throw $ Fault_H.syscall_error.InvalidArgument 1;
whenE (pptrBase \<le> VPtr start \<or> pptrBase < VPtr end) $ throw Fault_H.syscall_error.IllegalOperation;
(pd, asid) <- case arch_capability.PageDirectoryCap x51 x52 of arch_capability.PageDirectoryCap pd None \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0 | arch_capability.PageDirectoryCap pd (Some asid) \<Rightarrow> returnOk (pd, asid) | _ \<Rightarrow> throw $ Fault_H.syscall_error.InvalidCapability 0;
pdCheck <- lookupErrorOnFailure False $ findPDForASID asid;
whenE (pdCheck \<noteq> pd) $ throw $ Fault_H.syscall_error.InvalidCapability 0;
(withoutFailure $ resolveVAddr (capPDBasePtr (arch_capability.PageDirectoryCap x51 x52)) (VPtr start)) >>=E case_option (returnOk $ invocation.InvokePageDirectory ARM_H.PageDirectoryNothing) (\<lambda>frameInfo. doE withoutFailure $ checkValidMappingSize (fst frameInfo);
baseStart <- returnOk (pageBase (VPtr start) (fst frameInfo));
baseEnd <- returnOk (pageBase (VPtr end - 1) (fst frameInfo));
whenE (baseStart \<noteq> baseEnd) $ throw $ Fault_H.syscall_error.RangeError start $ fromVPtr $ baseStart + mask (pageBitsForSize (fst frameInfo));
offset <- returnOk (start && mask (pageBitsForSize (fst frameInfo)));
pStart <- returnOk (snd frameInfo + id offset);
returnOk $ invocation.InvokePageDirectory $ ARM_H.PageDirectoryFlush (labelToFlushType label) (VPtr start) (VPtr end - 1) pStart pd asid
odE)
odE \<lbrace>valid_arch_inv'\<rbrace>, -
 2. \<And>x51 x52. \<lbrakk>arch_cap = arch_capability.PageDirectoryCap x51 x52; \<not> isPDFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>x51 x52. \<lbrakk>arch_cap = arch_capability.PageDirectoryCap x51 x52; \<not> isPDFlushLabel (invocation_type label)\<rbrakk> \<Longrightarrow> \<lbrace>invs' and valid_cap' (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) and cte_wp_at' ((=) (capability.ArchObjectCap (arch_capability.PageDirectoryCap x51 x52)) \<circ> cteCap) slot and (\<lambda>s. \<forall>x\<in>set excaps. cte_wp_at' ((=) (fst x) \<circ> cteCap) (snd x) s) and sch_act_simple and (\<lambda>s. vs_valid_duplicates' (ksPSpace s))\<rbrace> throwError Fault_H.syscall_error.IllegalOperation \<lbrace>valid_arch_inv'\<rbrace>, - proof (prove)
goal:
No subgoals!