theory ArchArch_AC

lemma decode_arch_invocation_authorised:
  "\<lbrace>invs and pas_refined aag and cte_wp_at ((=) (ArchObjectCap cap)) slot
         and (\<lambda>s. \<forall>(cap, slot) \<in> set excaps. cte_wp_at ((=) cap) slot s)
         and K (\<forall>(cap, slot) \<in> {(ArchObjectCap cap, slot)} \<union> set excaps.
                  aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and>
                  is_subject aag (fst slot) \<and>
                  (\<forall>v \<in> cap_asid' cap. is_subject_asid aag v))\<rbrace>
   arch_decode_invocation label msg x_slot slot cap excaps
   \<lbrace>authorised_arch_inv aag\<rbrace>, -" unfolding arch_decode_invocation_def authorised_arch_inv_def aag_cap_auth_def apply (rule hoare_pre) apply (simp add: split_def Let_def split del: if_split
              cong: cap.case_cong arch_cap.case_cong if_cong option.case_cong) apply (wp whenE_throwError_wp check_vp_wpR find_pd_for_asid_authority2
          | wpc
          | simp add: authorised_asid_control_inv_def authorised_page_inv_def
                      authorised_page_directory_inv_def
                 del: hoare_True_E_R
                 split del: if_split)+ apply (clarsimp simp: authorised_asid_pool_inv_def authorised_page_table_inv_def
                        neq_Nil_conv invs_psp_aligned invs_vspace_objs cli_no_irqs) apply (drule cte_wp_valid_cap, clarsimp+) apply (cases cap; simp)
      \<comment> \<open>asid pool\<close> apply (find_goal \<open>match premises in "cap = ASIDPoolCap _ _" \<Rightarrow> succeed\<close>) subgoal for s obj_ref asid by (clarsimp simp: cap_auth_conferred_def arch_cap_auth_conferred_def is_page_cap_def
                          pas_refined_all_auth_is_owns asid_high_bits_of_add_ucast valid_cap_simps)
     \<comment> \<open>ControlCap\<close> apply (find_goal \<open>match premises in "cap = ASIDControlCap" \<Rightarrow> succeed\<close>) subgoal apply (clarsimp simp: neq_Nil_conv split_def valid_cap_simps) apply (cases excaps, solves simp) apply (clarsimp simp: neq_Nil_conv aag_has_Control_iff_owns) apply (drule cte_wp_at_valid_objs_valid_cap, clarsimp) apply (clarsimp simp: valid_cap_def cap_aligned_def) apply (clarsimp simp: is_cap_simps cap_auth_conferred_def
                            pas_refined_all_auth_is_owns aag_cap_auth_def) done
   \<comment> \<open>PageCap\<close> apply (find_goal \<open>match premises in "cap = PageCap _ _ _ _ _" \<Rightarrow> succeed\<close>) subgoal for s is_dev obj_ref cap_rights vmpage_size mapping apply (clarsimp simp: valid_cap_simps cli_no_irqs) apply (cases "invocation_type label"; (solves \<open>simp\<close>)?) apply (find_goal \<open>match premises in "_ = ArchInvocationLabel _" \<Rightarrow> succeed\<close>) apply (rename_tac archlabel) apply (case_tac archlabel; (solves \<open>simp\<close>)?)
       \<comment> \<open>Map\<close> apply (find_goal \<open>match premises in "_ = ARMPageMap" \<Rightarrow> succeed\<close>) subgoal apply (clarsimp simp: cap_auth_conferred_def arch_cap_auth_conferred_def is_cap_simps is_page_cap_def
                             pas_refined_all_auth_is_owns) apply (rule conjI) apply (clarsimp simp: is_page_cap_def pas_refined_all_auth_is_owns
                              aag_cap_auth_def cli_no_irqs cap_links_asid_slot_def) apply (simp only: linorder_not_le kernel_base_less_observation
                          vmsz_aligned_t2n_neg_mask simp_thms) apply (clarsimp simp: cap_auth_conferred_def arch_cap_auth_conferred_def
                               vspace_cap_rights_to_auth_def mask_vm_rights_def
                               validate_vm_rights_def vm_read_only_def vm_kernel_only_def) apply clarsimp apply (clarsimp simp: cap_auth_conferred_def arch_cap_auth_conferred_def aag_cap_auth_def
                               cli_no_irqs vspace_cap_rights_to_auth_def mask_vm_rights_def
                              validate_vm_rights_def vm_read_only_def vm_kernel_only_def) done
     \<comment> \<open>Unmap\<close> subgoal by (simp add: aag_cap_auth_def cli_no_irqs) done
  \<comment> \<open>PageTableCap\<close> apply (find_goal \<open>match premises in "cap = PageTableCap _ _" \<Rightarrow> succeed\<close>) subgoal for s word option apply (cases "invocation_type label"; (solves \<open>simp\<close>)?) apply (find_goal \<open>match premises in "_ = ArchInvocationLabel _" \<Rightarrow> succeed\<close>) apply (rename_tac archlabel) apply (case_tac archlabel; (solves \<open>simp\<close>)?)
     \<comment> \<open>PTMap\<close> apply (find_goal \<open>match premises in "_ = ARMPageTableMap" \<Rightarrow> succeed\<close>) apply (clarsimp simp: aag_cap_auth_def cli_no_irqs cap_links_asid_slot_def
                           cap_auth_conferred_def arch_cap_auth_conferred_def is_page_cap_def
                           pde_ref2_def pas_refined_all_auth_is_owns pas_refined_refl
                           pd_shifting[folded pd_bits_14])
    \<comment> \<open>Unmap\<close> apply (find_goal \<open>match premises in "_ = ARMPageTableUnmap" \<Rightarrow> succeed\<close>) subgoal apply (clarsimp simp: aag_cap_auth_def cli_no_irqs cap_links_asid_slot_def
                            cap_auth_conferred_def arch_cap_auth_conferred_def is_page_cap_def
                            pde_ref2_def pas_refined_all_auth_is_owns pas_refined_refl) apply (subgoal_tac "x && ~~ mask pt_bits = word") apply simp apply (clarsimp simp: valid_cap_simps cap_aligned_def split: if_split_asm) apply (subst (asm) upto_enum_step_subtract) apply (subgoal_tac "is_aligned word pt_bits") apply (simp add: is_aligned_no_overflow) apply (simp add: pt_bits_def pageBits_def) apply simp apply (subst (asm) upto_enum_step_red [where us = 2, simplified]) apply (simp add: pt_bits_def pageBits_def word_bits_conv) apply (simp add: pt_bits_def pageBits_def word_bits_conv) apply clarsimp apply (subst is_aligned_add_helper) apply (simp add: pt_bits_def pageBits_def) apply (erule word_less_power_trans_ofnat [where k = 2, simplified]) apply (simp add: pt_bits_def pageBits_def) apply (simp add: pt_bits_def pageBits_def word_bits_conv) apply simp done done done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs and pas_refined aag and cte_wp_at ((=) (ArchObjectCap cap)) slot and (\<lambda>s. \<forall>(cap, slot)\<in>set excaps. cte_wp_at ((=) cap) slot s) and K (\<forall>(cap, slot)\<in>{(ArchObjectCap cap, slot)} \<union> set excaps. aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v))\<rbrace> arch_decode_invocation label msg x_slot slot cap excaps \<lbrace>authorised_arch_inv aag\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs and pas_refined aag and cte_wp_at ((=) (ArchObjectCap cap)) slot and (\<lambda>s. \<forall>(cap, slot)\<in>set excaps. cte_wp_at ((=) cap) slot s) and K (\<forall>(cap, slot)\<in>{(ArchObjectCap cap, slot)} \<union> set excaps. ((\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v))\<rbrace> case cap of ASIDPoolCap p base \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMASIDPoolAssign then if 0 < length excaps then let (pd_cap, pd_cap_slot) = excaps ! 0 in case pd_cap of ArchObjectCap (PageDirectoryCap x None) \<Rightarrow> doE asid_table <- liftE $ gets (arm_asid_table \<circ> arch_state);
pool_ptr <- returnOk (asid_table (asid_high_bits_of base));
whenE (pool_ptr = None) $ throwError $ FailedLookup False InvalidRoot;
whenE (p \<noteq> the pool_ptr) $ throwError $ InvalidCapability 0;
pool <- liftE $ get_asid_pool p;
free_set <- returnOk (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + base \<noteq> 0});
whenE (free_set = {}) $ throwError DeleteFirst;
offset <- liftE $ select_ext (\<lambda>_. free_asid_pool_select pool base) free_set;
returnOk $ InvokeASIDPool $ Assign (UCAST(10 \<rightarrow> 32) offset + base) p pd_cap_slot
odE | ArchObjectCap (PageDirectoryCap x (Some a)) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1 else throwError TruncatedMessage else throwError IllegalOperation | ASIDControlCap \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMASIDControlMakePool then if 1 < length msg \<and> 1 < length excaps then let index = msg ! 0; depth = msg ! 1; (untyped, parent_slot) = excaps ! 0; root = fst (excaps ! 1) in doE asid_table <- liftE $ gets (arm_asid_table \<circ> arch_state);
free_set <- returnOk (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
whenE (free_set = {}) $ throwError DeleteFirst;
free <- liftE $ select_ext (\<lambda>_. free_asid_select asid_table) free_set;
base <- returnOk (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits);
(p, n) <- case untyped of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1;
frame <- if n = pageBits then doE ensure_no_children parent_slot;
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- lookup_target_slot root (to_bl index) (unat depth);
ensure_empty dest_slot;
returnOk $ InvokeASIDControl $ MakePool frame dest_slot parent_slot base
odE else throwError TruncatedMessage else throwError IllegalOperation | PageCap dev p R pgsz mapped_address \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length msg \<and> 0 < length excaps then let vaddr = msg ! 0; rights_mask = msg ! 1; attr = msg ! 2; pd_cap = fst (excaps ! 0) in doE (pd, asid) <- case pd_cap of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
case mapped_address of None \<Rightarrow> doE vtop <- returnOk (vaddr + (1 << pageBitsForSize pgsz) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> vaddr) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 1;
vm_rights <- returnOk (mask_vm_rights R (data_to_rights rights_mask));
check_vp_alignment pgsz vaddr;
entries <- create_mapping_entries (addrFromPPtr p) vaddr pgsz vm_rights (attribs_from_word attr) pd;
ensure_safe_mapping entries;
returnOk $ InvokePage $ PageMap asid (ArchObjectCap $ PageCap dev p R pgsz (Some (asid, vaddr))) slot entries
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk $ InvokePage $ PageUnmap cap slot else if isPageFlushLabel (invocation_type label) then if 1 < length msg then let start = msg ! 0; end = msg ! 1 in doE (asid, vaddr) <- case mapped_address of None \<Rightarrow> throwError IllegalOperation | Some a \<Rightarrow> returnOk a;
pd <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (end \<le> start) $ throwError $ InvalidArgument 1;
page_size <- returnOk $ 1 << pageBitsForSize pgsz;
whenE (page_size \<le> start \<or> page_size < end) $ throwError $ InvalidArgument 0;
returnOk $ InvokePage $ PageFlush (label_to_flush_type (invocation_type label)) (start + vaddr) (end + vaddr - 1) (addrFromPPtr p + start) pd asid
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk $ InvokePage $ PageGetAddr p else throwError IllegalOperation | PageTableCap p mapped_address \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMPageTableMap then if 1 < length msg \<and> 0 < length excaps then let vaddr = msg ! 0; attr = msg ! 1; pd_cap = fst (excaps ! 0) in doE whenE (mapped_address \<noteq> None) $ throwError $ InvalidCapability 0;
(pd, asid) <- case pd_cap of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
whenE (kernel_base \<le> vaddr) $ throwError $ InvalidArgument 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 1;
pd_index <- returnOk (vaddr >> 20);
vaddr' <- returnOk (vaddr && ~~ mask 20);
pd_slot <- returnOk (pd + (pd_index << 2));
oldpde <- liftE $ get_master_pde pd_slot;
unlessE (oldpde = InvalidPDE) $ throwError DeleteFirst;
pde <- returnOk (PageTablePDE (addrFromPPtr p) (attribs_from_word attr \<inter> {ParityEnabled}) 0);
returnOk $ InvokePageTable $ PageTableMap (ArchObjectCap $ PageTableCap p (Some (asid, vaddr'))) slot pde pd_slot
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageTableUnmap then doE final <- liftE $ is_final_cap (ArchObjectCap cap);
unlessE final $ throwError RevokeFirst;
returnOk $ InvokePageTable $ PageTableUnmap (ArchObjectCap cap) slot
odE else throwError IllegalOperation | PageDirectoryCap x xa \<Rightarrow> if isPDFlushLabel (invocation_type label) then if 1 < length msg then let start = msg ! 0; end = msg ! 1 in doE whenE (end \<le> start) $ throwError $ InvalidArgument 1;
whenE (kernel_base \<le> start \<or> kernel_base < end) $ throwError IllegalOperation;
(pd, asid) <- case cap of PageDirectoryCap pd None \<Rightarrow> throwError $ InvalidCapability 0 | PageDirectoryCap pd (Some asid) \<Rightarrow> returnOk (pd, asid) | _ \<Rightarrow> throwError $ InvalidCapability 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 0;
frame_info <- liftE $ resolve_vaddr pd start;
case frame_info of None \<Rightarrow> returnOk $ InvokePageDirectory PageDirectoryNothing | Some (frame_size, frame_base) \<Rightarrow> let base_start = page_base start frame_size; base_end = page_base (end - 1) frame_size; offset = start && mask (pageBitsForSize frame_size); pstart = frame_base + offset in doE whenE (base_start \<noteq> base_end) $ throwError $ RangeError start (base_start + mask (pageBitsForSize frame_size));
returnOk $ InvokePageDirectory $ PageDirectoryFlush (label_to_flush_type (invocation_type label)) start (end - 1) pstart pd asid
odE
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>\<lambda>ai s. case ai of InvokePageTable x \<Rightarrow> authorised_page_table_inv aag x | InvokePageDirectory x \<Rightarrow> authorised_page_directory_inv aag x | InvokePage x \<Rightarrow> authorised_page_inv aag x | InvokeASIDControl x \<Rightarrow> authorised_asid_control_inv aag x | InvokeASIDPool x \<Rightarrow> authorised_asid_pool_inv aag x\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<lbrace>?P'\<rbrace> case cap of ASIDPoolCap p base \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMASIDPoolAssign then if 0 < length excaps then let (pd_cap, pd_cap_slot) = excaps ! 0 in case pd_cap of ArchObjectCap (PageDirectoryCap x None) \<Rightarrow> doE asid_table <- liftE $ gets (arm_asid_table \<circ> arch_state);
pool_ptr <- returnOk (asid_table (asid_high_bits_of base));
whenE (pool_ptr = None) $ throwError $ FailedLookup False InvalidRoot;
whenE (p \<noteq> the pool_ptr) $ throwError $ InvalidCapability 0;
pool <- liftE $ get_asid_pool p;
free_set <- returnOk (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + base \<noteq> 0});
whenE (free_set = {}) $ throwError DeleteFirst;
offset <- liftE $ select_ext (\<lambda>_. free_asid_pool_select pool base) free_set;
returnOk $ InvokeASIDPool $ Assign (UCAST(10 \<rightarrow> 32) offset + base) p pd_cap_slot
odE | ArchObjectCap (PageDirectoryCap x (Some a)) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1 else throwError TruncatedMessage else throwError IllegalOperation | ASIDControlCap \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMASIDControlMakePool then if 1 < length msg \<and> 1 < length excaps then let index = msg ! 0; depth = msg ! 1; (untyped, parent_slot) = excaps ! 0; root = fst (excaps ! 1) in doE asid_table <- liftE $ gets (arm_asid_table \<circ> arch_state);
free_set <- returnOk (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
whenE (free_set = {}) $ throwError DeleteFirst;
free <- liftE $ select_ext (\<lambda>_. free_asid_select asid_table) free_set;
base <- returnOk (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits);
(p, n) <- case untyped of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1;
frame <- if n = pageBits then doE ensure_no_children parent_slot;
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- lookup_target_slot root (to_bl index) (unat depth);
ensure_empty dest_slot;
returnOk $ InvokeASIDControl $ MakePool frame dest_slot parent_slot base
odE else throwError TruncatedMessage else throwError IllegalOperation | PageCap dev p R pgsz mapped_address \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length msg \<and> 0 < length excaps then let vaddr = msg ! 0; rights_mask = msg ! 1; attr = msg ! 2; pd_cap = fst (excaps ! 0) in doE (pd, asid) <- case pd_cap of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
case mapped_address of None \<Rightarrow> doE vtop <- returnOk (vaddr + (1 << pageBitsForSize pgsz) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> vaddr) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 1;
vm_rights <- returnOk (mask_vm_rights R (data_to_rights rights_mask));
check_vp_alignment pgsz vaddr;
entries <- create_mapping_entries (addrFromPPtr p) vaddr pgsz vm_rights (attribs_from_word attr) pd;
ensure_safe_mapping entries;
returnOk $ InvokePage $ PageMap asid (ArchObjectCap $ PageCap dev p R pgsz (Some (asid, vaddr))) slot entries
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk $ InvokePage $ PageUnmap cap slot else if isPageFlushLabel (invocation_type label) then if 1 < length msg then let start = msg ! 0; end = msg ! 1 in doE (asid, vaddr) <- case mapped_address of None \<Rightarrow> throwError IllegalOperation | Some a \<Rightarrow> returnOk a;
pd <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (end \<le> start) $ throwError $ InvalidArgument 1;
page_size <- returnOk $ 1 << pageBitsForSize pgsz;
whenE (page_size \<le> start \<or> page_size < end) $ throwError $ InvalidArgument 0;
returnOk $ InvokePage $ PageFlush (label_to_flush_type (invocation_type label)) (start + vaddr) (end + vaddr - 1) (addrFromPPtr p + start) pd asid
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk $ InvokePage $ PageGetAddr p else throwError IllegalOperation | PageTableCap p mapped_address \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMPageTableMap then if 1 < length msg \<and> 0 < length excaps then let vaddr = msg ! 0; attr = msg ! 1; pd_cap = fst (excaps ! 0) in doE whenE (mapped_address \<noteq> None) $ throwError $ InvalidCapability 0;
(pd, asid) <- case pd_cap of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
whenE (kernel_base \<le> vaddr) $ throwError $ InvalidArgument 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 1;
pd_index <- returnOk (vaddr >> 20);
vaddr' <- returnOk (vaddr && ~~ mask 20);
pd_slot <- returnOk (pd + (pd_index << 2));
oldpde <- liftE $ get_master_pde pd_slot;
unlessE (oldpde = InvalidPDE) $ throwError DeleteFirst;
pde <- returnOk (PageTablePDE (addrFromPPtr p) (attribs_from_word attr \<inter> {ParityEnabled}) 0);
returnOk $ InvokePageTable $ PageTableMap (ArchObjectCap $ PageTableCap p (Some (asid, vaddr'))) slot pde pd_slot
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageTableUnmap then doE final <- liftE $ is_final_cap (ArchObjectCap cap);
unlessE final $ throwError RevokeFirst;
returnOk $ InvokePageTable $ PageTableUnmap (ArchObjectCap cap) slot
odE else throwError IllegalOperation | PageDirectoryCap x xa \<Rightarrow> if isPDFlushLabel (invocation_type label) then if 1 < length msg then let start = msg ! 0; end = msg ! 1 in doE whenE (end \<le> start) $ throwError $ InvalidArgument 1;
whenE (kernel_base \<le> start \<or> kernel_base < end) $ throwError IllegalOperation;
(pd, asid) <- case cap of PageDirectoryCap pd None \<Rightarrow> throwError $ InvalidCapability 0 | PageDirectoryCap pd (Some asid) \<Rightarrow> returnOk (pd, asid) | _ \<Rightarrow> throwError $ InvalidCapability 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 0;
frame_info <- liftE $ resolve_vaddr pd start;
case frame_info of None \<Rightarrow> returnOk $ InvokePageDirectory PageDirectoryNothing | Some (frame_size, frame_base) \<Rightarrow> let base_start = page_base start frame_size; base_end = page_base (end - 1) frame_size; offset = start && mask (pageBitsForSize frame_size); pstart = frame_base + offset in doE whenE (base_start \<noteq> base_end) $ throwError $ RangeError start (base_start + mask (pageBitsForSize frame_size));
returnOk $ InvokePageDirectory $ PageDirectoryFlush (label_to_flush_type (invocation_type label)) start (end - 1) pstart pd asid
odE
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>\<lambda>ai s. case ai of InvokePageTable x \<Rightarrow> authorised_page_table_inv aag x | InvokePageDirectory x \<Rightarrow> authorised_page_directory_inv aag x | InvokePage x \<Rightarrow> authorised_page_inv aag x | InvokeASIDControl x \<Rightarrow> authorised_asid_control_inv aag x | InvokeASIDPool x \<Rightarrow> authorised_asid_pool_inv aag x\<rbrace>, -
 2. \<And>s. (invs and pas_refined aag and cte_wp_at ((=) (ArchObjectCap cap)) slot and (\<lambda>s. \<forall>(cap, slot)\<in>set excaps. cte_wp_at ((=) cap) slot s) and K (\<forall>(cap, slot)\<in>{(ArchObjectCap cap, slot)} \<union> set excaps. ((\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v))) s \<Longrightarrow> ?P' s proof (prove)
goal (2 subgoals):
 1. \<lbrace>?P'\<rbrace> case cap of ASIDPoolCap p base \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMASIDPoolAssign then if excaps \<noteq> [] then case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap x None) \<Rightarrow> doE asid_table <- liftE (gets (arm_asid_table \<circ> arch_state));
y <- whenE (asid_table (asid_high_bits_of base) = None) (throwError (FailedLookup False InvalidRoot));
y <- whenE (p \<noteq> the (asid_table (asid_high_bits_of base))) (throwError (InvalidCapability 0));
pool <- liftE (get_asid_pool p);
y <- whenE (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + base \<noteq> 0} = {}) (throwError DeleteFirst);
offset <- liftE (select_ext (\<lambda>_. free_asid_pool_select pool base) (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + base \<noteq> 0}));
returnOk (InvokeASIDPool (Assign (UCAST(10 \<rightarrow> 32) offset + base) p (snd (excaps ! 0))))
odE | ArchObjectCap (PageDirectoryCap x (Some a)) \<Rightarrow> throwError (InvalidCapability (Suc 0)) | ArchObjectCap _ \<Rightarrow> throwError (InvalidCapability (Suc 0)) | _ \<Rightarrow> throwError (InvalidCapability (Suc 0)) else throwError TruncatedMessage else throwError IllegalOperation | ASIDControlCap \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMASIDControlMakePool then if Suc 0 < length msg \<and> Suc 0 < length excaps then doE asid_table <- liftE (gets (arm_asid_table \<circ> arch_state));
y <- whenE (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} = {}) (throwError DeleteFirst);
free <- liftE (select_ext (\<lambda>_. free_asid_select asid_table) (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}));
p <- case fst (excaps ! 0) of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError (InvalidCapability (Suc 0));
frame <- if snd p = pageBits then doE y <- ensure_no_children (snd (excaps ! 0));
returnOk (fst p)
odE else throwError (InvalidCapability (Suc 0));
dest_slot <- lookup_slot_for_cnode_op False (fst (excaps ! Suc 0)) (to_bl (msg ! 0)) (unat (msg ! Suc 0));
y <- ensure_empty dest_slot;
returnOk (InvokeASIDControl (MakePool frame dest_slot (snd (excaps ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE else throwError TruncatedMessage else throwError IllegalOperation | PageCap dev p R pgsz mapped_address \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length msg \<and> excaps \<noteq> [] then doE pa <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError (InvalidCapability (Suc 0)) | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError (InvalidCapability (Suc 0)) | _ \<Rightarrow> throwError (InvalidCapability (Suc 0));
y <- case mapped_address of None \<Rightarrow> whenE (kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize pgsz - 1) (throwError (InvalidArgument 0)) | Some a \<Rightarrow> doE y <- whenE (fst a \<noteq> snd pa) (throwError (InvalidCapability (Suc 0)));
whenE (snd a \<noteq> msg ! 0) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd pa));
y <- whenE (pd' \<noteq> fst pa) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz (msg ! 0);
entries <- create_mapping_entries (addrFromPPtr p) (msg ! 0) pgsz (mask_vm_rights R (data_to_rights (msg ! Suc 0))) (attribs_from_word (msg ! 2)) (fst pa);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd pa) (ArchObjectCap (PageCap dev p R pgsz (Some (snd pa, msg ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap dev p R pgsz mapped_address) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length msg then doE pa <- case mapped_address of None \<Rightarrow> throwError IllegalOperation | Some x2 \<Rightarrow> returnOk x2;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst pa));
y <- whenE (msg ! Suc 0 \<le> msg ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> msg ! 0 \<or> 2 ^ pageBitsForSize pgsz < msg ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (msg ! 0 + snd pa) (msg ! Suc 0 + snd pa - 1) (addrFromPPtr p + msg ! 0) pd (fst pa)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr p)) else throwError IllegalOperation | PageTableCap p mapped_address \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMPageTableMap then if Suc 0 < length msg \<and> excaps \<noteq> [] then doE y <- whenE (\<exists>a b. mapped_address = Some (a, b)) (throwError (InvalidCapability 0));
pa <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError (InvalidCapability (Suc 0)) | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError (InvalidCapability (Suc 0)) | _ \<Rightarrow> throwError (InvalidCapability (Suc 0));
y <- whenE (kernel_base \<le> msg ! 0) (throwError (InvalidArgument 0));
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd pa));
y <- whenE (pd' \<noteq> fst pa) (throwError (InvalidCapability (Suc 0)));
oldpde <- liftE (get_master_pde (fst pa + (msg ! 0 >> 20 << 2)));
y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (InvokePageTable (PageTableMap (ArchObjectCap (PageTableCap p (Some (snd pa, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr p) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (fst pa + (msg ! 0 >> 20 << 2))))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageTableUnmap then doE final <- liftE (is_final_cap (ArchObjectCap (PageTableCap p mapped_address)));
y <- unlessE final (throwError RevokeFirst);
returnOk (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap p mapped_address)) slot))
odE else throwError IllegalOperation | PageDirectoryCap x xa \<Rightarrow> if isPDFlushLabel (invocation_type label) then if Suc 0 < length msg then doE y <- whenE (msg ! Suc 0 \<le> msg ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> msg ! 0 \<or> kernel_base < msg ! Suc 0) (throwError IllegalOperation);
p <- case xa of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (x, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability 0));
liftE (resolve_vaddr (fst p) (msg ! 0)) >>=E case_option (returnOk (InvokePageDirectory PageDirectoryNothing)) (\<lambda>a. doE y <- whenE (page_base (msg ! 0) (fst a) \<noteq> page_base (msg ! Suc 0 - 1) (fst a)) (throwError (RangeError (msg ! 0) (page_base (msg ! 0) (fst a) + mask (pageBitsForSize (fst a)))));
returnOk (InvokePageDirectory (PageDirectoryFlush (label_to_flush_type (invocation_type label)) (msg ! 0) (msg ! Suc 0 - 1) (snd a + (msg ! 0 && mask (pageBitsForSize (fst a)))) (fst p) (snd p)))
odE)
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>\<lambda>ai s. case ai of InvokePageTable x \<Rightarrow> authorised_page_table_inv aag x | InvokePageDirectory x \<Rightarrow> authorised_page_directory_inv aag x | InvokePage x \<Rightarrow> authorised_page_inv aag x | InvokeASIDControl x \<Rightarrow> authorised_asid_control_inv aag x | InvokeASIDPool x \<Rightarrow> authorised_asid_pool_inv aag x\<rbrace>, -
 2. \<And>s. (invs and pas_refined aag and cte_wp_at ((=) (ArchObjectCap cap)) slot and (\<lambda>s. \<forall>(cap, slot)\<in>set excaps. cte_wp_at ((=) cap) slot s) and K (\<forall>(cap, slot)\<in>{(ArchObjectCap cap, slot)} \<union> set excaps. ((\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v))) s \<Longrightarrow> ?P' s proof (prove)
goal (1 subgoal):
 1. \<And>s. invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> (\<forall>x\<in>aobj_ref' cap. \<forall>auth\<in>cap_auth_conferred (ArchObjectCap cap). (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)) \<Longrightarrow> (\<forall>x xa. cap = ASIDPoolCap x xa \<longrightarrow> invocation_type label = ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> excaps \<noteq> [] \<longrightarrow> (\<forall>xb. fst (excaps ! 0) = ArchObjectCap xb \<longrightarrow> (\<exists>x. xb = PageDirectoryCap x None) \<longrightarrow> (\<exists>y. asid_table s (asid_high_bits_of xa) = Some y) \<longrightarrow> x = the (asid_table s (asid_high_bits_of xa)) \<longrightarrow> (\<forall>pool. ako_at (ASIDPool pool) (the (asid_table s (asid_high_bits_of xa))) s \<longrightarrow> - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + xa \<noteq> 0} \<noteq> {} \<longrightarrow> free_asid_pool_select pool xa \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool xa) + xa \<noteq> 0 \<longrightarrow> authorised_asid_pool_inv aag (Assign (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool xa) + xa) (the (asid_table s (asid_high_bits_of xa))) (snd (excaps ! 0)))))) \<and> (cap = ASIDControlCap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> Suc 0 < length msg \<and> Suc 0 < length excaps \<longrightarrow> - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> free_asid_select (asid_table s) \<notin> dom (asid_table s) \<and> free_asid_select (asid_table s) \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> (\<forall>x xa. (\<exists>xb. fst (excaps ! 0) = UntypedCap x xa pageBits xb) \<longrightarrow> \<not> x \<longrightarrow> (is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x)) \<and> is_aligned xa pageBits \<and> is_subject aag (fst (snd (excaps ! 0))) \<and> (\<forall>x\<in>{xa..xa + 2 ^ pageBits - 1}. is_subject aag x))) \<and> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> excaps \<noteq> [] \<longrightarrow> (\<forall>xe. fst (excaps ! 0) = ArchObjectCap xe \<longrightarrow> (\<forall>xf xg. xe = PageDirectoryCap xf xg \<longrightarrow> (\<forall>xe. xg = Some xe \<longrightarrow> (xd = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize xc - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s) \<longrightarrow> vmsz_aligned (msg ! 0) xc \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x xa xb xc (Some (xe, msg ! 0)))) \<and> (\<exists>ref. (ref \<rhd> xf) s) \<and> is_subject aag xf \<and> is_aligned xf pd_bits \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (xd = Some (xe, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s) \<longrightarrow> vmsz_aligned (msg ! 0) xc \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x xa xb xc (Some (xe, msg ! 0)))) \<and> (\<exists>ref. (ref \<rhd> xf) s) \<and> is_subject aag xf \<and> is_aligned xf pd_bits \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x xa xb xc xd)))) \<and> (\<forall>x xa. cap = PageTableCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> excaps \<noteq> [] \<longrightarrow> xa = None \<longrightarrow> (\<forall>xa. fst (excaps ! 0) = ArchObjectCap xa \<longrightarrow> (\<forall>xb xc. xa = PageDirectoryCap xb xc \<longrightarrow> (\<forall>xa. xc = Some xa \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xa, Control, pasObjectAbs aag xb) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xb pd_bits) \<and> (\<exists>ref. (ref \<rhd> xb) s) \<longrightarrow> authorised_page_table_inv aag (PageTableMap (ArchObjectCap (PageTableCap x (Some (xa, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (xb + (msg ! 0 >> 20 << 2))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> authorised_page_table_inv aag (PageTableUnmap (ArchObjectCap (PageTableCap x xa)) slot))) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap cap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>x\<in>aobj_ref' cap. \<forall>auth\<in>cap_auth_conferred (ArchObjectCap cap). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap cap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' cap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)\<rbrakk> \<Longrightarrow> (\<forall>x xa. cap = ASIDPoolCap x xa \<longrightarrow> invocation_type label = ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>xb. fst (excaps ! 0) = ArchObjectCap xb \<longrightarrow> (\<exists>x. xb = PageDirectoryCap x None) \<longrightarrow> (\<exists>y. asid_table s (asid_high_bits_of xa) = Some y) \<longrightarrow> x = the (asid_table s (asid_high_bits_of xa)) \<longrightarrow> (\<forall>pool. ako_at (ASIDPool pool) (the (asid_table s (asid_high_bits_of xa))) s \<longrightarrow> - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + xa \<noteq> 0} \<noteq> {} \<longrightarrow> free_asid_pool_select pool xa \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool xa) + xa \<noteq> 0 \<longrightarrow> is_subject aag (the (asid_table s (asid_high_bits_of xa))) \<and> is_subject aag (fst (snd (excaps ! 0))) \<and> (\<forall>asid'. asid_high_bits_of asid' = asid_high_bits_of (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool xa) + xa) \<and> asid' \<noteq> 0 \<longrightarrow> is_subject_asid aag asid')))) \<and> (cap = ASIDControlCap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> Suc 0 < length msg \<and> Suc 0 < length excaps \<longrightarrow> - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> free_asid_select (asid_table s) \<notin> dom (asid_table s) \<and> free_asid_select (asid_table s) \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> (\<forall>x xa. (\<exists>xb. fst (excaps ! 0) = UntypedCap x xa pageBits xb) \<longrightarrow> \<not> x \<longrightarrow> (is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x)) \<and> is_aligned xa pageBits \<and> is_subject aag (fst (snd (excaps ! 0))) \<and> (\<forall>x\<in>{xa..xa + 2 ^ pageBits - 1}. is_subject aag x))) \<and> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>xe. fst (excaps ! 0) = ArchObjectCap xe \<longrightarrow> (\<forall>xf xg. xe = PageDirectoryCap xf xg \<longrightarrow> (\<forall>xe. xg = Some xe \<longrightarrow> (xd = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize xc - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> is_aligned xf pd_bits \<and> (\<exists>ref. (ref \<rhd> xf) s) \<longrightarrow> vmsz_aligned (msg ! 0) xc \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x xa xb xc (Some (xe, msg ! 0)))) \<and> (\<exists>ref. (ref \<rhd> xf) s) \<and> is_subject aag xf \<and> is_aligned xf pd_bits \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (xd = Some (xe, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> is_aligned xf pd_bits \<and> (\<exists>ref. (ref \<rhd> xf) s) \<longrightarrow> vmsz_aligned (msg ! 0) xc \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x xa xb xc (Some (xe, msg ! 0)))) \<and> (\<exists>ref. (ref \<rhd> xf) s) \<and> is_subject aag xf \<and> is_aligned xf pd_bits \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x xa xb xc xd)))) \<and> (\<forall>x xa. cap = PageTableCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> xa = None \<longrightarrow> (\<forall>xa. fst (excaps ! 0) = ArchObjectCap xa \<longrightarrow> (\<forall>xb xc. xa = PageDirectoryCap xb xc \<longrightarrow> (\<forall>xa. xc = Some xa \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xa, Control, pasObjectAbs aag xb) \<in> pasPolicy aag) \<and> is_aligned xb pd_bits \<and> (\<exists>ref. (ref \<rhd> xb) s) \<longrightarrow> is_subject aag (xb + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) \<and> (case pde_ref2 (PageTablePDE (addrFromPPtr x) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) of None \<Rightarrow> True | Some x2 \<Rightarrow> is_subject aag (fst x2)) \<and> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap x (Some (xa, msg ! 0 && ~~ mask 20)))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap x xa)) \<and> ((\<exists>asid vspace_ref. xa = Some (asid, vspace_ref)) \<longrightarrow> (\<forall>x\<in>set [x , x + 4 .e. x + 2 ^ pt_bits - 1]. is_subject aag (x && ~~ mask pt_bits))))) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>x\<in>aobj_ref' cap. \<forall>auth\<in>cap_auth_conferred (ArchObjectCap cap). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap cap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' cap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap cap\<rbrakk> \<Longrightarrow> (\<forall>x xa. cap = ASIDPoolCap x xa \<longrightarrow> invocation_type label = ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>xb. fst (excaps ! 0) = ArchObjectCap xb \<longrightarrow> (\<exists>x. xb = PageDirectoryCap x None) \<longrightarrow> (\<exists>y. asid_table s (asid_high_bits_of xa) = Some y) \<longrightarrow> x = the (asid_table s (asid_high_bits_of xa)) \<longrightarrow> (\<forall>pool. ako_at (ASIDPool pool) (the (asid_table s (asid_high_bits_of xa))) s \<longrightarrow> - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + xa \<noteq> 0} \<noteq> {} \<longrightarrow> free_asid_pool_select pool xa \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool xa) + xa \<noteq> 0 \<longrightarrow> is_subject aag (the (asid_table s (asid_high_bits_of xa))) \<and> is_subject aag (fst (snd (excaps ! 0))) \<and> (\<forall>asid'. asid_high_bits_of asid' = asid_high_bits_of (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool xa) + xa) \<and> asid' \<noteq> 0 \<longrightarrow> is_subject_asid aag asid')))) \<and> (cap = ASIDControlCap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> Suc 0 < length msg \<and> Suc 0 < length excaps \<longrightarrow> - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> free_asid_select (asid_table s) \<notin> dom (asid_table s) \<and> free_asid_select (asid_table s) \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> (\<forall>x xa. (\<exists>xb. fst (excaps ! 0) = UntypedCap x xa pageBits xb) \<longrightarrow> \<not> x \<longrightarrow> (is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x)) \<and> is_aligned xa pageBits \<and> is_subject aag (fst (snd (excaps ! 0))) \<and> (\<forall>x\<in>{xa..xa + 2 ^ pageBits - 1}. is_subject aag x))) \<and> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>xe. fst (excaps ! 0) = ArchObjectCap xe \<longrightarrow> (\<forall>xf xg. xe = PageDirectoryCap xf xg \<longrightarrow> (\<forall>xe. xg = Some xe \<longrightarrow> (xd = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize xc - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> is_aligned xf pd_bits \<and> (\<exists>ref. (ref \<rhd> xf) s) \<longrightarrow> vmsz_aligned (msg ! 0) xc \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x xa xb xc (Some (xe, msg ! 0)))) \<and> (\<exists>ref. (ref \<rhd> xf) s) \<and> is_subject aag xf \<and> is_aligned xf pd_bits \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (xd = Some (xe, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> is_aligned xf pd_bits \<and> (\<exists>ref. (ref \<rhd> xf) s) \<longrightarrow> vmsz_aligned (msg ! 0) xc \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x xa xb xc (Some (xe, msg ! 0)))) \<and> (\<exists>ref. (ref \<rhd> xf) s) \<and> is_subject aag xf \<and> is_aligned xf pd_bits \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x xa xb xc xd)))) \<and> (\<forall>x xa. cap = PageTableCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> xa = None \<longrightarrow> (\<forall>xa. fst (excaps ! 0) = ArchObjectCap xa \<longrightarrow> (\<forall>xb xc. xa = PageDirectoryCap xb xc \<longrightarrow> (\<forall>xa. xc = Some xa \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xa, Control, pasObjectAbs aag xb) \<in> pasPolicy aag) \<and> is_aligned xb pd_bits \<and> (\<exists>ref. (ref \<rhd> xb) s) \<longrightarrow> is_subject aag (xb + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) \<and> (case pde_ref2 (PageTablePDE (addrFromPPtr x) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) of None \<Rightarrow> True | Some x2 \<Rightarrow> is_subject aag (fst x2)) \<and> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap x (Some (xa, msg ! 0 && ~~ mask 20)))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap x xa)) \<and> ((\<exists>asid vspace_ref. xa = Some (asid, vspace_ref)) \<longrightarrow> (\<forall>x\<in>set [x , x + 4 .e. x + 2 ^ pt_bits - 1]. is_subject aag (x && ~~ mask pt_bits))))) proof (prove)
goal (4 subgoals):
 1. \<And>s x11 x12. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (ASIDPoolCap x11 x12)). (pasSubject aag, auth, pasObjectAbs aag x11) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (ASIDPoolCap x11 x12)); is_subject aag (fst slot); \<forall>v. asid_high_bits_of v = asid_high_bits_of x12 \<and> v \<noteq> 0 \<longrightarrow> is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (ASIDPoolCap x11 x12); cap = ASIDPoolCap x11 x12\<rbrakk> \<Longrightarrow> invocation_type label = ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<exists>xa. x = PageDirectoryCap xa None) \<longrightarrow> (\<exists>y. asid_table s (asid_high_bits_of x12) = Some y) \<longrightarrow> x11 = the (asid_table s (asid_high_bits_of x12)) \<longrightarrow> (\<forall>pool. ako_at (ASIDPool pool) (the (asid_table s (asid_high_bits_of x12))) s \<longrightarrow> - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + x12 \<noteq> 0} \<noteq> {} \<longrightarrow> free_asid_pool_select pool x12 \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool x12) + x12 \<noteq> 0 \<longrightarrow> is_subject aag (the (asid_table s (asid_high_bits_of x12))) \<and> is_subject aag (fst (snd (excaps ! 0))) \<and> (\<forall>asid'. asid_high_bits_of asid' = asid_high_bits_of (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool x12) + x12) \<and> asid' \<noteq> 0 \<longrightarrow> is_subject_asid aag asid')))
 2. \<And>s. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot); s \<turnstile> ArchObjectCap ASIDControlCap; cap = ASIDControlCap\<rbrakk> \<Longrightarrow> invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> Suc 0 < length msg \<and> Suc 0 < length excaps \<longrightarrow> - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> free_asid_select (asid_table s) \<notin> dom (asid_table s) \<and> free_asid_select (asid_table s) \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> (\<forall>x xa. (\<exists>xb. fst (excaps ! 0) = UntypedCap x xa pageBits xb) \<longrightarrow> \<not> x \<longrightarrow> (is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x)) \<and> is_aligned xa pageBits \<and> is_subject aag (fst (snd (excaps ! 0))) \<and> (\<forall>x\<in>{xa..xa + 2 ^ pageBits - 1}. is_subject aag x))
 3. \<And>s x31 x32 x33 x34 x35. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>x\<in>ptr_range x32 (pageBitsForSize x34). \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageCap x31 x32 x33 x34 x35)). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_subject aag (fst slot); \<forall>v\<in>set_option x35. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 x35); cap = PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (x35 = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize x34 - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) x34 \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (x, msg ! 0)))) \<and> (\<exists>ref. (ref \<rhd> xa) s) \<and> is_subject aag xa \<and> is_aligned xa pd_bits \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights x33 (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range x32 (pageBitsForSize x34). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (x35 = Some (x, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) x34 \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (x, msg ! 0)))) \<and> (\<exists>ref. (ref \<rhd> xa) s) \<and> is_subject aag xa \<and> is_aligned xa pd_bits \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights x33 (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range x32 (pageBitsForSize x34). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x31 x32 x33 x34 x35)))
 4. \<And>s x41 x42. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageTableCap x41 x42)). (pasSubject aag, auth, pasObjectAbs aag x41) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageTableCap x41 x42)); is_subject aag (fst slot); \<forall>v\<in>set_option x42. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> x42 = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> is_subject aag (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) \<and> (case pde_ref2 (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) of None \<Rightarrow> True | Some x2 \<Rightarrow> is_subject aag (fst x2)) \<and> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap x41 x42)) \<and> ((\<exists>asid vspace_ref. x42 = Some (asid, vspace_ref)) \<longrightarrow> (\<forall>x\<in>set [x41 , x41 + 4 .e. x41 + 2 ^ pt_bits - 1]. is_subject aag (x && ~~ mask pt_bits)))) proof (prove)
goal (4 subgoals):
 1. \<And>s x11 x12. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (ASIDPoolCap x11 x12)). (pasSubject aag, auth, pasObjectAbs aag x11) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (ASIDPoolCap x11 x12)); is_subject aag (fst slot); \<forall>v. asid_high_bits_of v = asid_high_bits_of x12 \<and> v \<noteq> 0 \<longrightarrow> is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (ASIDPoolCap x11 x12); cap = ASIDPoolCap x11 x12\<rbrakk> \<Longrightarrow> invocation_type label = ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<exists>xa. x = PageDirectoryCap xa None) \<longrightarrow> (\<exists>y. asid_table s (asid_high_bits_of x12) = Some y) \<longrightarrow> x11 = the (asid_table s (asid_high_bits_of x12)) \<longrightarrow> (\<forall>pool. ako_at (ASIDPool pool) (the (asid_table s (asid_high_bits_of x12))) s \<longrightarrow> - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + x12 \<noteq> 0} \<noteq> {} \<longrightarrow> free_asid_pool_select pool x12 \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool x12) + x12 \<noteq> 0 \<longrightarrow> is_subject aag (the (asid_table s (asid_high_bits_of x12))) \<and> is_subject aag (fst (snd (excaps ! 0))) \<and> (\<forall>asid'. asid_high_bits_of asid' = asid_high_bits_of (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool x12) + x12) \<and> asid' \<noteq> 0 \<longrightarrow> is_subject_asid aag asid')))
 2. \<And>s. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot); s \<turnstile> ArchObjectCap ASIDControlCap; cap = ASIDControlCap\<rbrakk> \<Longrightarrow> invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> Suc 0 < length msg \<and> Suc 0 < length excaps \<longrightarrow> - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> free_asid_select (asid_table s) \<notin> dom (asid_table s) \<and> free_asid_select (asid_table s) \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> (\<forall>x xa. (\<exists>xb. fst (excaps ! 0) = UntypedCap x xa pageBits xb) \<longrightarrow> \<not> x \<longrightarrow> (is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x)) \<and> is_aligned xa pageBits \<and> is_subject aag (fst (snd (excaps ! 0))) \<and> (\<forall>x\<in>{xa..xa + 2 ^ pageBits - 1}. is_subject aag x))
 3. \<And>s x31 x32 x33 x34 x35. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>x\<in>ptr_range x32 (pageBitsForSize x34). \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageCap x31 x32 x33 x34 x35)). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_subject aag (fst slot); \<forall>v\<in>set_option x35. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 x35); cap = PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (x35 = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize x34 - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) x34 \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (x, msg ! 0)))) \<and> (\<exists>ref. (ref \<rhd> xa) s) \<and> is_subject aag xa \<and> is_aligned xa pd_bits \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights x33 (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range x32 (pageBitsForSize x34). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (x35 = Some (x, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) x34 \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (x, msg ! 0)))) \<and> (\<exists>ref. (ref \<rhd> xa) s) \<and> is_subject aag xa \<and> is_aligned xa pd_bits \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights x33 (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range x32 (pageBitsForSize x34). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x31 x32 x33 x34 x35)))
 4. \<And>s x41 x42. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageTableCap x41 x42)). (pasSubject aag, auth, pasObjectAbs aag x41) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageTableCap x41 x42)); is_subject aag (fst slot); \<forall>v\<in>set_option x42. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> x42 = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> is_subject aag (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) \<and> (case pde_ref2 (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) of None \<Rightarrow> True | Some x2 \<Rightarrow> is_subject aag (fst x2)) \<and> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap x41 x42)) \<and> ((\<exists>asid vspace_ref. x42 = Some (asid, vspace_ref)) \<longrightarrow> (\<forall>x\<in>set [x41 , x41 + 4 .e. x41 + 2 ^ pt_bits - 1]. is_subject aag (x && ~~ mask pt_bits)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (ASIDPoolCap obj_ref asid)). (pasSubject aag, auth, pasObjectAbs aag obj_ref) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (ASIDPoolCap obj_ref asid)); is_subject aag (fst slot); \<forall>v. asid_high_bits_of v = asid_high_bits_of asid \<and> v \<noteq> 0 \<longrightarrow> is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (ASIDPoolCap obj_ref asid); cap = ASIDPoolCap obj_ref asid\<rbrakk> \<Longrightarrow> invocation_type label = ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<exists>xa. x = PageDirectoryCap xa None) \<longrightarrow> (\<exists>y. asid_table s (asid_high_bits_of asid) = Some y) \<longrightarrow> obj_ref = the (asid_table s (asid_high_bits_of asid)) \<longrightarrow> (\<forall>pool. ako_at (ASIDPool pool) (the (asid_table s (asid_high_bits_of asid))) s \<longrightarrow> - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {} \<longrightarrow> free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> is_subject aag (the (asid_table s (asid_high_bits_of asid))) \<and> is_subject aag (fst (snd (excaps ! 0))) \<and> (\<forall>asid'. asid_high_bits_of asid' = asid_high_bits_of (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) \<and> asid' \<noteq> 0 \<longrightarrow> is_subject_asid aag asid'))) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot); s \<turnstile> ArchObjectCap ASIDControlCap; cap = ASIDControlCap\<rbrakk> \<Longrightarrow> invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> Suc 0 < length msg \<and> Suc 0 < length excaps \<longrightarrow> - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> free_asid_select (asid_table s) \<notin> dom (asid_table s) \<and> free_asid_select (asid_table s) \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> (\<forall>x xa. (\<exists>xb. fst (excaps ! 0) = UntypedCap x xa pageBits xb) \<longrightarrow> \<not> x \<longrightarrow> (is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x)) \<and> is_aligned xa pageBits \<and> is_subject aag (fst (snd (excaps ! 0))) \<and> (\<forall>x\<in>{xa..xa + 2 ^ pageBits - 1}. is_subject aag x))
 2. \<And>s x31 x32 x33 x34 x35. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>x\<in>ptr_range x32 (pageBitsForSize x34). \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageCap x31 x32 x33 x34 x35)). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_subject aag (fst slot); \<forall>v\<in>set_option x35. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 x35); cap = PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (x35 = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize x34 - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) x34 \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (x, msg ! 0)))) \<and> (\<exists>ref. (ref \<rhd> xa) s) \<and> is_subject aag xa \<and> is_aligned xa pd_bits \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights x33 (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range x32 (pageBitsForSize x34). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (x35 = Some (x, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) x34 \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (x, msg ! 0)))) \<and> (\<exists>ref. (ref \<rhd> xa) s) \<and> is_subject aag xa \<and> is_aligned xa pd_bits \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights x33 (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range x32 (pageBitsForSize x34). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x31 x32 x33 x34 x35)))
 3. \<And>s x41 x42. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageTableCap x41 x42)). (pasSubject aag, auth, pasObjectAbs aag x41) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageTableCap x41 x42)); is_subject aag (fst slot); \<forall>v\<in>set_option x42. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> x42 = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> is_subject aag (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) \<and> (case pde_ref2 (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) of None \<Rightarrow> True | Some x2 \<Rightarrow> is_subject aag (fst x2)) \<and> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap x41 x42)) \<and> ((\<exists>asid vspace_ref. x42 = Some (asid, vspace_ref)) \<longrightarrow> (\<forall>x\<in>set [x41 , x41 + 4 .e. x41 + 2 ^ pt_bits - 1]. is_subject aag (x && ~~ mask pt_bits)))) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot); s \<turnstile> ArchObjectCap ASIDControlCap; cap = ASIDControlCap\<rbrakk> \<Longrightarrow> invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> Suc 0 < length msg \<and> Suc 0 < length excaps \<longrightarrow> - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> free_asid_select (asid_table s) \<notin> dom (asid_table s) \<and> free_asid_select (asid_table s) \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> (\<forall>x xa. (\<exists>xb. fst (excaps ! 0) = UntypedCap x xa pageBits xb) \<longrightarrow> \<not> x \<longrightarrow> (is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x)) \<and> is_aligned xa pageBits \<and> is_subject aag (fst (snd (excaps ! 0))) \<and> (\<forall>x\<in>{xa..xa + 2 ^ pageBits - 1}. is_subject aag x))
 2. \<And>s x31 x32 x33 x34 x35. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>x\<in>ptr_range x32 (pageBitsForSize x34). \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageCap x31 x32 x33 x34 x35)). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_subject aag (fst slot); \<forall>v\<in>set_option x35. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 x35); cap = PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (x35 = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize x34 - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) x34 \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (x, msg ! 0)))) \<and> (\<exists>ref. (ref \<rhd> xa) s) \<and> is_subject aag xa \<and> is_aligned xa pd_bits \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights x33 (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range x32 (pageBitsForSize x34). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (x35 = Some (x, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) x34 \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (x, msg ! 0)))) \<and> (\<exists>ref. (ref \<rhd> xa) s) \<and> is_subject aag xa \<and> is_aligned xa pd_bits \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights x33 (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range x32 (pageBitsForSize x34). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x31 x32 x33 x34 x35)))
 3. \<And>s x41 x42. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageTableCap x41 x42)). (pasSubject aag, auth, pasObjectAbs aag x41) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageTableCap x41 x42)); is_subject aag (fst slot); \<forall>v\<in>set_option x42. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> x42 = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> is_subject aag (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) \<and> (case pde_ref2 (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) of None \<Rightarrow> True | Some x2 \<Rightarrow> is_subject aag (fst x2)) \<and> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap x41 x42)) \<and> ((\<exists>asid vspace_ref. x42 = Some (asid, vspace_ref)) \<longrightarrow> (\<forall>x\<in>set [x41 , x41 + 4 .e. x41 + 2 ^ pt_bits - 1]. is_subject aag (x && ~~ mask pt_bits)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs s_; pas_refined aag s_; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s_; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot); s_ \<turnstile> ArchObjectCap ASIDControlCap; cap = ASIDControlCap\<rbrakk> \<Longrightarrow> invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> Suc 0 < length msg \<and> Suc 0 < length excaps \<longrightarrow> - dom (asid_table s_) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> free_asid_select (asid_table s_) \<notin> dom (asid_table s_) \<and> free_asid_select (asid_table s_) \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> (\<forall>x xa. (\<exists>xb. fst (excaps ! 0) = UntypedCap x xa pageBits xb) \<longrightarrow> \<not> x \<longrightarrow> (is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x)) \<and> is_aligned xa pageBits \<and> is_subject aag (fst (snd (excaps ! 0))) \<and> (\<forall>x\<in>{xa..xa + 2 ^ pageBits - 1}. is_subject aag x)) proof (prove)
goal (1 subgoal):
 1. \<And>x xa xb. \<lbrakk>invs s_; pas_refined aag s_; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s_; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v. is_subject_asid aag v; \<forall>x\<in>set excaps. (\<forall>xa\<in>obj_refs_ac (fst x). \<forall>auth\<in>cap_auth_conferred (fst x). (pasObjectAbs aag (fst (snd x)), auth, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> (\<forall>xa\<in>untyped_range (fst x). (pasObjectAbs aag (fst (snd x)), Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst (snd x))) (fst x) \<and> cap_links_irq aag (pasObjectAbs aag (fst (snd x))) (fst x) \<and> is_subject aag (fst (snd x)); cap_aligned (ArchObjectCap ASIDControlCap); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length msg; Suc 0 < length excaps; - dom (asid_table s_) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; free_asid_select (asid_table s_) \<le> 2 ^ local.asid_high_bits - 1; asid_table s_ (free_asid_select (asid_table s_)) = None; fst (excaps ! 0) = UntypedCap False xa pageBits xb; \<not> x\<rbrakk> \<Longrightarrow> (is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x)) \<and> is_aligned xa pageBits \<and> is_subject aag (fst (snd (excaps ! 0))) \<and> (\<forall>x\<in>{xa..xa + 2 ^ pageBits - 1}. is_subject aag x) proof (prove)
goal (1 subgoal):
 1. \<And>x xa xb a list. \<lbrakk>invs s_; pas_refined aag s_; \<forall>x\<in>set excaps. cte_wp_at ((=) (fst x)) (snd x) s_; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v. is_subject_asid aag v; \<forall>x\<in>set excaps. (\<forall>xa\<in>obj_refs_ac (fst x). \<forall>auth\<in>cap_auth_conferred (fst x). (pasObjectAbs aag (fst (snd x)), auth, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> (\<forall>xa\<in>untyped_range (fst x). (pasObjectAbs aag (fst (snd x)), Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst (snd x))) (fst x) \<and> cap_links_irq aag (pasObjectAbs aag (fst (snd x))) (fst x) \<and> is_subject aag (fst (snd x)); cap_aligned (ArchObjectCap ASIDControlCap); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length msg; Suc 0 < length excaps; - dom (asid_table s_) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; free_asid_select (asid_table s_) \<le> 2 ^ local.asid_high_bits - 1; asid_table s_ (free_asid_select (asid_table s_)) = None; fst (excaps ! 0) = UntypedCap False xa pageBits xb; \<not> x; excaps = a # list\<rbrakk> \<Longrightarrow> (is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x)) \<and> is_aligned xa pageBits \<and> is_subject aag (fst (snd (excaps ! 0))) \<and> (\<forall>x\<in>{xa..xa + 2 ^ pageBits - 1}. is_subject aag x) proof (prove)
goal (1 subgoal):
 1. \<And>x xa xb aa b ab ac ba ys. \<lbrakk>invs s_; pas_refined aag s_; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v. is_subject_asid aag v; cap_aligned (ArchObjectCap ASIDControlCap); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length msg; - dom (asid_table s_) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; free_asid_select (asid_table s_) \<le> 2 ^ local.asid_high_bits - 1; asid_table s_ (free_asid_select (asid_table s_)) = None; \<not> x; excaps = (UntypedCap False xa pageBits xb, aa, b) # (ab, ac, ba) # ys; cte_wp_at ((=) (UntypedCap False xa pageBits xb)) (aa, b) s_; \<forall>x\<in>{xa..xa + 2 ^ pageBits - 1}. is_subject aag x; cap_links_asid_slot aag (pasSubject aag) (UntypedCap False xa pageBits xb); cap_links_irq aag (pasSubject aag) (UntypedCap False xa pageBits xb); is_subject aag aa; cte_wp_at ((=) ab) (ac, ba) s_; \<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s_; \<forall>x\<in>obj_refs_ac ab. \<forall>auth\<in>cap_auth_conferred ab. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range ab. is_subject aag x; cap_links_asid_slot aag (pasSubject aag) ab; cap_links_irq aag (pasSubject aag) ab; is_subject aag ac; \<forall>x\<in>set ys. (\<forall>xa\<in>obj_refs_ac (fst x). \<forall>auth\<in>cap_auth_conferred (fst x). (pasObjectAbs aag (fst (snd x)), auth, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> (\<forall>xa\<in>untyped_range (fst x). (pasObjectAbs aag (fst (snd x)), Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst (snd x))) (fst x) \<and> cap_links_irq aag (pasObjectAbs aag (fst (snd x))) (fst x) \<and> is_subject aag (fst (snd x))\<rbrakk> \<Longrightarrow> (is_cnode_cap ab \<longrightarrow> (\<forall>x\<in>obj_refs_ac ab. is_subject aag x)) \<and> is_aligned xa pageBits proof (prove)
goal (1 subgoal):
 1. \<And>x xa xb aa b ab ac ba ys. \<lbrakk>invs s_; pas_refined aag s_; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v. is_subject_asid aag v; cap_aligned (ArchObjectCap ASIDControlCap); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length msg; - dom (asid_table s_) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; free_asid_select (asid_table s_) \<le> 2 ^ local.asid_high_bits - 1; asid_table s_ (free_asid_select (asid_table s_)) = None; \<not> x; excaps = (UntypedCap False xa pageBits xb, aa, b) # (ab, ac, ba) # ys; \<forall>x\<in>{xa..xa + 2 ^ pageBits - 1}. is_subject aag x; cap_links_asid_slot aag (pasSubject aag) (UntypedCap False xa pageBits xb); cap_links_irq aag (pasSubject aag) (UntypedCap False xa pageBits xb); is_subject aag aa; cte_wp_at ((=) ab) (ac, ba) s_; \<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s_; \<forall>x\<in>obj_refs_ac ab. \<forall>auth\<in>cap_auth_conferred ab. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range ab. is_subject aag x; cap_links_asid_slot aag (pasSubject aag) ab; cap_links_irq aag (pasSubject aag) ab; is_subject aag ac; \<forall>x\<in>set ys. (\<forall>xa\<in>obj_refs_ac (fst x). \<forall>auth\<in>cap_auth_conferred (fst x). (pasObjectAbs aag (fst (snd x)), auth, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> (\<forall>xa\<in>untyped_range (fst x). (pasObjectAbs aag (fst (snd x)), Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst (snd x))) (fst x) \<and> cap_links_irq aag (pasObjectAbs aag (fst (snd x))) (fst x) \<and> is_subject aag (fst (snd x)); \<exists>cap. UntypedCap False xa pageBits xb = cap \<and> s_ \<turnstile> cap\<rbrakk> \<Longrightarrow> (is_cnode_cap ab \<longrightarrow> (\<forall>x\<in>obj_refs_ac ab. is_subject aag x)) \<and> is_aligned xa pageBits proof (prove)
goal (1 subgoal):
 1. \<And>x xa xb aa b ab ac ba ys xc. \<lbrakk>invs s_; pas_refined aag s_; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v. is_subject_asid aag v; 0 < word_bits; cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length msg; - dom (asid_table s_) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; free_asid_select (asid_table s_) \<le> 2 ^ local.asid_high_bits - 1; asid_table s_ (free_asid_select (asid_table s_)) = None; \<not> x; excaps = (UntypedCap False xa pageBits xb, aa, b) # (ab, ac, ba) # ys; \<forall>x\<in>{xa..xa + 2 ^ pageBits - 1}. is_subject aag x; cap_links_asid_slot aag (pasSubject aag) (UntypedCap False xa pageBits xb); cap_links_irq aag (pasSubject aag) (UntypedCap False xa pageBits xb); is_subject aag aa; cte_wp_at ((=) ab) (ac, ba) s_; \<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s_; \<forall>x\<in>obj_refs_ac ab. \<forall>auth\<in>cap_auth_conferred ab. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; \<forall>x\<in>untyped_range ab. is_subject aag x; cap_links_asid_slot aag (pasSubject aag) ab; cap_links_irq aag (pasSubject aag) ab; is_subject aag ac; \<forall>x\<in>set ys. (\<forall>xa\<in>obj_refs_ac (fst x). \<forall>auth\<in>cap_auth_conferred (fst x). (pasObjectAbs aag (fst (snd x)), auth, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> (\<forall>xa\<in>untyped_range (fst x). (pasObjectAbs aag (fst (snd x)), Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst (snd x))) (fst x) \<and> cap_links_irq aag (pasObjectAbs aag (fst (snd x))) (fst x) \<and> is_subject aag (fst (snd x)); is_aligned xa pageBits; valid_untyped (UntypedCap False xa pageBits xb) s_; untyped_min_bits \<le> pageBits; xb \<le> 2 ^ pageBits; xa \<noteq> 0; is_cnode_cap ab; xc \<in> obj_refs_ac ab\<rbrakk> \<Longrightarrow> is_subject aag xc proof (prove)
goal:
No subgoals! proof (prove)
goal (2 subgoals):
 1. \<And>s x31 x32 x33 x34 x35. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>x\<in>ptr_range x32 (pageBitsForSize x34). \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageCap x31 x32 x33 x34 x35)). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_subject aag (fst slot); \<forall>v\<in>set_option x35. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 x35); cap = PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (x35 = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize x34 - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) x34 \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (x, msg ! 0)))) \<and> (\<exists>ref. (ref \<rhd> xa) s) \<and> is_subject aag xa \<and> is_aligned xa pd_bits \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights x33 (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range x32 (pageBitsForSize x34). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (x35 = Some (x, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) x34 \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (x, msg ! 0)))) \<and> (\<exists>ref. (ref \<rhd> xa) s) \<and> is_subject aag xa \<and> is_aligned xa pd_bits \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights x33 (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range x32 (pageBitsForSize x34). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x31 x32 x33 x34 x35)))
 2. \<And>s x41 x42. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageTableCap x41 x42)). (pasSubject aag, auth, pasObjectAbs aag x41) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageTableCap x41 x42)); is_subject aag (fst slot); \<forall>v\<in>set_option x42. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> x42 = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> is_subject aag (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) \<and> (case pde_ref2 (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) of None \<Rightarrow> True | Some x2 \<Rightarrow> is_subject aag (fst x2)) \<and> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap x41 x42)) \<and> ((\<exists>asid vspace_ref. x42 = Some (asid, vspace_ref)) \<longrightarrow> (\<forall>x\<in>set [x41 , x41 + 4 .e. x41 + 2 ^ pt_bits - 1]. is_subject aag (x && ~~ mask pt_bits)))) proof (prove)
goal (2 subgoals):
 1. \<And>s x31 x32 x33 x34 x35. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>x\<in>ptr_range x32 (pageBitsForSize x34). \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageCap x31 x32 x33 x34 x35)). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); is_subject aag (fst slot); \<forall>v\<in>set_option x35. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 x35); cap = PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (x35 = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize x34 - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) x34 \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (x, msg ! 0)))) \<and> (\<exists>ref. (ref \<rhd> xa) s) \<and> is_subject aag xa \<and> is_aligned xa pd_bits \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights x33 (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range x32 (pageBitsForSize x34). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (x35 = Some (x, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) x34 \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (x, msg ! 0)))) \<and> (\<exists>ref. (ref \<rhd> xa) s) \<and> is_subject aag xa \<and> is_aligned xa pd_bits \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights x33 (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range x32 (pageBitsForSize x34). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap x31 x32 x33 x34 x35)))
 2. \<And>s x41 x42. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageTableCap x41 x42)). (pasSubject aag, auth, pasObjectAbs aag x41) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageTableCap x41 x42)); is_subject aag (fst slot); \<forall>v\<in>set_option x42. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> x42 = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> is_subject aag (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) \<and> (case pde_ref2 (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) of None \<Rightarrow> True | Some x2 \<Rightarrow> is_subject aag (fst x2)) \<and> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap x41 x42)) \<and> ((\<exists>asid vspace_ref. x42 = Some (asid, vspace_ref)) \<longrightarrow> (\<forall>x\<in>set [x41 , x41 + 4 .e. x41 + 2 ^ pt_bits - 1]. is_subject aag (x && ~~ mask pt_bits)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); is_subject aag (fst slot); \<forall>v\<in>set_option mapping. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping); cap = PageCap is_dev obj_ref cap_rights vmpage_size mapping\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (mapping = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> (\<exists>ref. (ref \<rhd> xa) s) \<and> is_subject aag xa \<and> is_aligned xa pd_bits \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (mapping = Some (x, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> (\<exists>ref. (ref \<rhd> xa) s) \<and> is_subject aag xa \<and> is_aligned xa pd_bits \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); is_subject aag (fst slot); \<forall>v\<in>set_option mapping. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageCap is_dev obj_ref cap_rights vmpage_size mapping; cap_aligned (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); if is_dev then typ_at (AArch (ADeviceData vmpage_size)) obj_ref s else typ_at (AArch (AUserData vmpage_size)) obj_ref s; cap_rights \<in> valid_vm_rights; case mapping of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (mapping = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (mapping = Some (x, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping))) proof (prove)
goal (1 subgoal):
 1. \<And>x2. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); is_subject aag (fst slot); \<forall>v\<in>set_option mapping. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageCap is_dev obj_ref cap_rights vmpage_size mapping; cap_aligned (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); if is_dev then typ_at (AArch (ADeviceData vmpage_size)) obj_ref s else typ_at (AArch (AUserData vmpage_size)) obj_ref s; cap_rights \<in> valid_vm_rights; case mapping of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel x2\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (mapping = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (mapping = Some (x, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping))) proof (prove)
goal (1 subgoal):
 1. \<And>x2. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); is_subject aag (fst slot); \<forall>v\<in>set_option mapping. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageCap is_dev obj_ref cap_rights vmpage_size mapping; cap_aligned (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); if is_dev then typ_at (AArch (ADeviceData vmpage_size)) obj_ref s else typ_at (AArch (AUserData vmpage_size)) obj_ref s; cap_rights \<in> valid_vm_rights; case mapping of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel x2\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (mapping = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (mapping = Some (x, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping))) proof (prove)
goal (1 subgoal):
 1. \<And>archlabel. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); is_subject aag (fst slot); \<forall>v\<in>set_option mapping. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageCap is_dev obj_ref cap_rights vmpage_size mapping; cap_aligned (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); if is_dev then typ_at (AArch (ADeviceData vmpage_size)) obj_ref s else typ_at (AArch (AUserData vmpage_size)) obj_ref s; cap_rights \<in> valid_vm_rights; case mapping of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel archlabel\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (mapping = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (mapping = Some (x, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping))) proof (prove)
goal (2 subgoals):
 1. \<And>archlabel. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); is_subject aag (fst slot); \<forall>v\<in>set_option mapping. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageCap is_dev obj_ref cap_rights vmpage_size mapping; cap_aligned (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); if is_dev then typ_at (AArch (ADeviceData vmpage_size)) obj_ref s else typ_at (AArch (AUserData vmpage_size)) obj_ref s; cap_rights \<in> valid_vm_rights; case mapping of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel archlabel; archlabel = ARMPageMap\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (mapping = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (mapping = Some (x, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)))
 2. \<And>archlabel. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); is_subject aag (fst slot); \<forall>v\<in>set_option mapping. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageCap is_dev obj_ref cap_rights vmpage_size mapping; cap_aligned (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); if is_dev then typ_at (AArch (ADeviceData vmpage_size)) obj_ref s else typ_at (AArch (AUserData vmpage_size)) obj_ref s; cap_rights \<in> valid_vm_rights; case mapping of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel archlabel; archlabel = ARMPageUnmap\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (mapping = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (mapping = Some (x, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping))) proof (prove)
goal (2 subgoals):
 1. \<And>archlabel. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); is_subject aag (fst slot); \<forall>v\<in>set_option mapping. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageCap is_dev obj_ref cap_rights vmpage_size mapping; cap_aligned (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); if is_dev then typ_at (AArch (ADeviceData vmpage_size)) obj_ref s else typ_at (AArch (AUserData vmpage_size)) obj_ref s; cap_rights \<in> valid_vm_rights; case mapping of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel archlabel; archlabel = ARMPageMap\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (mapping = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (mapping = Some (x, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)))
 2. \<And>archlabel. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); is_subject aag (fst slot); \<forall>v\<in>set_option mapping. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageCap is_dev obj_ref cap_rights vmpage_size mapping; cap_aligned (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); if is_dev then typ_at (AArch (ADeviceData vmpage_size)) obj_ref s else typ_at (AArch (AUserData vmpage_size)) obj_ref s; cap_rights \<in> valid_vm_rights; case mapping of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel archlabel; archlabel = ARMPageUnmap\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (mapping = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (mapping = Some (x, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); is_subject aag (fst slot); \<forall>v\<in>set_option mapping. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageCap is_dev obj_ref cap_rights vmpage_size mapping; cap_aligned (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); if is_dev then typ_at (AArch (ADeviceData vmpage_size)) obj_ref s else typ_at (AArch (AUserData vmpage_size)) obj_ref s; cap_rights \<in> valid_vm_rights; case mapping of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel archlabel_; archlabel_ = ARMPageMap\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (mapping = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (mapping = Some (x, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping))) proof (prove)
goal (1 subgoal):
 1. \<And>aa b ys xa xc. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>vspace_cap_rights_to_auth cap_rights. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); is_subject aag (fst slot); \<forall>v\<in>set_option mapping. is_subject_asid aag (fst v); cap = PageCap is_dev obj_ref cap_rights vmpage_size mapping; cap_aligned (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); if is_dev then typ_at (AArch (ADeviceData vmpage_size)) obj_ref s else typ_at (AArch (AUserData vmpage_size)) obj_ref s; cap_rights \<in> valid_vm_rights; case mapping of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageMap; archlabel_ = ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag xa; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageDirectoryCap xa (Some xc))); cap_links_irq aag (pasSubject aag) (ArchObjectCap (PageDirectoryCap xa (Some xc))); is_subject aag aa; is_subject_asid aag xc; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref x xa \<Rightarrow> reply_cap_rights_to_auth x xa | ArchObjectCap x \<Rightarrow> arch_cap_auth_conferred x | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)\<rbrakk> \<Longrightarrow> (mapping = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xc, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (xc, msg ! 0)))) \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (mapping = Some (xc, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xc, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (xc, msg ! 0)))) \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) proof (prove)
goal (2 subgoals):
 1. \<And>aa b ys xa xc. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>vspace_cap_rights_to_auth cap_rights. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); is_subject aag (fst slot); \<forall>v\<in>set_option mapping. is_subject_asid aag (fst v); cap = PageCap is_dev obj_ref cap_rights vmpage_size mapping; cap_aligned (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); if is_dev then typ_at (AArch (ADeviceData vmpage_size)) obj_ref s else typ_at (AArch (AUserData vmpage_size)) obj_ref s; cap_rights \<in> valid_vm_rights; case mapping of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageMap; archlabel_ = ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag xa; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageDirectoryCap xa (Some xc))); cap_links_irq aag (pasSubject aag) (ArchObjectCap (PageDirectoryCap xa (Some xc))); is_subject aag aa; is_subject_asid aag xc; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref x xa \<Rightarrow> reply_cap_rights_to_auth x xa | ArchObjectCap x \<Rightarrow> arch_cap_auth_conferred x | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)\<rbrakk> \<Longrightarrow> mapping = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xc, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (xc, msg ! 0)))) \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)
 2. \<And>aa b ys xa xc. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>vspace_cap_rights_to_auth cap_rights. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); is_subject aag (fst slot); \<forall>v\<in>set_option mapping. is_subject_asid aag (fst v); cap = PageCap is_dev obj_ref cap_rights vmpage_size mapping; cap_aligned (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); if is_dev then typ_at (AArch (ADeviceData vmpage_size)) obj_ref s else typ_at (AArch (AUserData vmpage_size)) obj_ref s; cap_rights \<in> valid_vm_rights; case mapping of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageMap; archlabel_ = ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag xa; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageDirectoryCap xa (Some xc))); cap_links_irq aag (pasSubject aag) (ArchObjectCap (PageDirectoryCap xa (Some xc))); is_subject aag aa; is_subject_asid aag xc; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref x xa \<Rightarrow> reply_cap_rights_to_auth x xa | ArchObjectCap x \<Rightarrow> arch_cap_auth_conferred x | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)\<rbrakk> \<Longrightarrow> mapping = Some (xc, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xc, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (xc, msg ! 0)))) \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag) proof (prove)
goal (2 subgoals):
 1. \<And>aa b ys xa xc ref. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>vspace_cap_rights_to_auth cap_rights. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; is_subject aag (fst slot); cap = PageCap is_dev obj_ref cap_rights vmpage_size None; cap_aligned (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size None)); if is_dev then typ_at (AArch (ADeviceData vmpage_size)) obj_ref s else typ_at (AArch (AUserData vmpage_size)) obj_ref s; cap_rights \<in> valid_vm_rights; invocation_type label = ArchInvocationLabel ARMPageMap; archlabel_ = ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag xa; label_owns_asid_slot aag (pasSubject aag) xc; is_subject aag aa; is_subject_asid aag xc; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref x xa \<Rightarrow> reply_cap_rights_to_auth x xa | ArchObjectCap x \<Rightarrow> arch_cap_auth_conferred x | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) x) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); mapping = None; \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xc, Control, pasObjectAbs aag xa) \<in> pasPolicy aag; is_aligned xa pd_bits; (ref \<rhd> xa) s; vmsz_aligned (msg ! 0) vmpage_size\<rbrakk> \<Longrightarrow> (\<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (xc, msg ! 0)))). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)
 2. \<And>aa b ys xa xc. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>vspace_cap_rights_to_auth cap_rights. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); is_subject aag (fst slot); \<forall>v\<in>set_option mapping. is_subject_asid aag (fst v); cap = PageCap is_dev obj_ref cap_rights vmpage_size mapping; cap_aligned (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); if is_dev then typ_at (AArch (ADeviceData vmpage_size)) obj_ref s else typ_at (AArch (AUserData vmpage_size)) obj_ref s; cap_rights \<in> valid_vm_rights; case mapping of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageMap; archlabel_ = ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag xa; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageDirectoryCap xa (Some xc))); cap_links_irq aag (pasSubject aag) (ArchObjectCap (PageDirectoryCap xa (Some xc))); is_subject aag aa; is_subject_asid aag xc; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref x xa \<Rightarrow> reply_cap_rights_to_auth x xa | ArchObjectCap x \<Rightarrow> arch_cap_auth_conferred x | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)\<rbrakk> \<Longrightarrow> mapping = Some (xc, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xc, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (xc, msg ! 0)))) \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag) proof (prove)
goal (2 subgoals):
 1. \<And>aa b ys xa xc ref. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>vspace_cap_rights_to_auth cap_rights. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; is_subject aag (fst slot); cap = PageCap is_dev obj_ref cap_rights vmpage_size None; cap_aligned (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size None)); if is_dev then typ_at (AArch (ADeviceData vmpage_size)) obj_ref s else typ_at (AArch (AUserData vmpage_size)) obj_ref s; cap_rights \<in> valid_vm_rights; invocation_type label = ArchInvocationLabel ARMPageMap; archlabel_ = ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag xa; label_owns_asid_slot aag (pasSubject aag) xc; is_subject aag aa; is_subject_asid aag xc; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref x xa \<Rightarrow> reply_cap_rights_to_auth x xa | ArchObjectCap x \<Rightarrow> arch_cap_auth_conferred x | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) x) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); mapping = None; msg ! 0 && ~~ mask 29 \<noteq> kernel_base; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xc, Control, pasObjectAbs aag xa) \<in> pasPolicy aag; is_aligned xa pd_bits; (ref \<rhd> xa) s; vmsz_aligned (msg ! 0) vmpage_size\<rbrakk> \<Longrightarrow> (\<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (xc, msg ! 0)))). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)
 2. \<And>aa b ys xa xc. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>vspace_cap_rights_to_auth cap_rights. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); is_subject aag (fst slot); \<forall>v\<in>set_option mapping. is_subject_asid aag (fst v); cap = PageCap is_dev obj_ref cap_rights vmpage_size mapping; cap_aligned (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); if is_dev then typ_at (AArch (ADeviceData vmpage_size)) obj_ref s else typ_at (AArch (AUserData vmpage_size)) obj_ref s; cap_rights \<in> valid_vm_rights; case mapping of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageMap; archlabel_ = ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag xa; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageDirectoryCap xa (Some xc))); cap_links_irq aag (pasSubject aag) (ArchObjectCap (PageDirectoryCap xa (Some xc))); is_subject aag aa; is_subject_asid aag xc; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref x xa \<Rightarrow> reply_cap_rights_to_auth x xa | ArchObjectCap x \<Rightarrow> arch_cap_auth_conferred x | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)\<rbrakk> \<Longrightarrow> mapping = Some (xc, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xc, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (xc, msg ! 0)))) \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag) proof (prove)
goal (1 subgoal):
 1. \<And>aa b ys xa xc. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>vspace_cap_rights_to_auth cap_rights. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); is_subject aag (fst slot); \<forall>v\<in>set_option mapping. is_subject_asid aag (fst v); cap = PageCap is_dev obj_ref cap_rights vmpage_size mapping; cap_aligned (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); if is_dev then typ_at (AArch (ADeviceData vmpage_size)) obj_ref s else typ_at (AArch (AUserData vmpage_size)) obj_ref s; cap_rights \<in> valid_vm_rights; case mapping of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageMap; archlabel_ = ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag xa; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageDirectoryCap xa (Some xc))); cap_links_irq aag (pasSubject aag) (ArchObjectCap (PageDirectoryCap xa (Some xc))); is_subject aag aa; is_subject_asid aag xc; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref x xa \<Rightarrow> reply_cap_rights_to_auth x xa | ArchObjectCap x \<Rightarrow> arch_cap_auth_conferred x | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)\<rbrakk> \<Longrightarrow> mapping = Some (xc, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xc, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (xc, msg ! 0)))) \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag) proof (prove)
goal (1 subgoal):
 1. \<And>aa b ys xa xc ref. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>vspace_cap_rights_to_auth cap_rights. (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (xc, msg ! 0)))); is_subject aag (fst slot); cap = PageCap is_dev obj_ref cap_rights vmpage_size (Some (xc, msg ! 0)); cap_aligned (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (xc, msg ! 0)))); if is_dev then typ_at (AArch (ADeviceData vmpage_size)) obj_ref s else typ_at (AArch (AUserData vmpage_size)) obj_ref s; cap_rights \<in> valid_vm_rights; invocation_type label = ArchInvocationLabel ARMPageMap; archlabel_ = ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag xa; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageDirectoryCap xa (Some xc))); cap_links_irq aag (pasSubject aag) (ArchObjectCap (PageDirectoryCap xa (Some xc))); is_subject aag aa; is_subject_asid aag xc; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref x xa \<Rightarrow> reply_cap_rights_to_auth x xa | ArchObjectCap x \<Rightarrow> arch_cap_auth_conferred x | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); mapping = Some (xc, msg ! 0); \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xc, Control, pasObjectAbs aag xa) \<in> pasPolicy aag; is_aligned xa pd_bits; (ref \<rhd> xa) s; vmsz_aligned (msg ! 0) vmpage_size; 0 < xc; xc < 2 ^ local.asid_bits; msg ! 0 < kernel_base\<rbrakk> \<Longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (xc, msg ! 0)))) \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag) proof (prove)
goal:
No subgoals! proof (prove)
goal (1 subgoal):
 1. \<And>archlabel. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); is_subject aag (fst slot); \<forall>v\<in>set_option mapping. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageCap is_dev obj_ref cap_rights vmpage_size mapping; cap_aligned (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); if is_dev then typ_at (AArch (ADeviceData vmpage_size)) obj_ref s else typ_at (AArch (AUserData vmpage_size)) obj_ref s; cap_rights \<in> valid_vm_rights; case mapping of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel archlabel; archlabel = ARMPageUnmap\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (mapping = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (mapping = Some (x, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>x\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)). (pasSubject aag, auth, pasObjectAbs aag x) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); is_subject aag (fst slot); \<forall>v\<in>set_option mapping. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageCap is_dev obj_ref cap_rights vmpage_size mapping; cap_aligned (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping)); if is_dev then typ_at (AArch (ADeviceData vmpage_size)) obj_ref s else typ_at (AArch (AUserData vmpage_size)) obj_ref s; cap_rights \<in> valid_vm_rights; case mapping of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel archlabel_; archlabel_ = ARMPageUnmap\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (mapping = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)) \<and> (mapping = Some (x, msg ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size (Some (x, msg ! 0)))) \<and> is_subject aag xa \<and> msg ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights cap_rights (data_to_rights (msg ! Suc 0))). \<forall>p\<in>ptr_range obj_ref (pageBitsForSize vmpage_size). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageCap is_dev obj_ref cap_rights vmpage_size mapping))) proof (prove)
goal:
No subgoals! proof (prove)
goal (1 subgoal):
 1. \<And>s x41 x42. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageTableCap x41 x42)). (pasSubject aag, auth, pasObjectAbs aag x41) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageTableCap x41 x42)); is_subject aag (fst slot); \<forall>v\<in>set_option x42. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> x42 = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> is_subject aag (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) \<and> (case pde_ref2 (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) of None \<Rightarrow> True | Some x2 \<Rightarrow> is_subject aag (fst x2)) \<and> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap x41 x42)) \<and> ((\<exists>asid vspace_ref. x42 = Some (asid, vspace_ref)) \<longrightarrow> (\<forall>x\<in>set [x41 , x41 + 4 .e. x41 + 2 ^ pt_bits - 1]. is_subject aag (x && ~~ mask pt_bits)))) proof (prove)
goal (1 subgoal):
 1. \<And>s x41 x42. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageTableCap x41 x42)). (pasSubject aag, auth, pasObjectAbs aag x41) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageTableCap x41 x42)); is_subject aag (fst slot); \<forall>v\<in>set_option x42. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> x42 = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> is_subject aag (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) \<and> (case pde_ref2 (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) of None \<Rightarrow> True | Some x2 \<Rightarrow> is_subject aag (fst x2)) \<and> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap x41 x42)) \<and> ((\<exists>asid vspace_ref. x42 = Some (asid, vspace_ref)) \<longrightarrow> (\<forall>x\<in>set [x41 , x41 + 4 .e. x41 + 2 ^ pt_bits - 1]. is_subject aag (x && ~~ mask pt_bits)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageTableCap word option)). (pasSubject aag, auth, pasObjectAbs aag word) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageTableCap word option)); is_subject aag (fst slot); \<forall>v\<in>set_option option. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap word option); cap = PageTableCap word option\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> option = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> is_subject aag (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) \<and> (case pde_ref2 (PageTablePDE (addrFromPPtr word) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) of None \<Rightarrow> True | Some x2 \<Rightarrow> is_subject aag (fst x2)) \<and> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word (Some (x, msg ! 0 && ~~ mask 20)))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word option)) \<and> ((\<exists>asid vspace_ref. option = Some (asid, vspace_ref)) \<longrightarrow> (\<forall>x\<in>set [word , word + 4 .e. word + 2 ^ pt_bits - 1]. is_subject aag (x && ~~ mask pt_bits)))) proof (prove)
goal (1 subgoal):
 1. \<And>x2. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageTableCap word option)). (pasSubject aag, auth, pasObjectAbs aag word) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageTableCap word option)); is_subject aag (fst slot); \<forall>v\<in>set_option option. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap word option); cap = PageTableCap word option; invocation_type label = ArchInvocationLabel x2\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> option = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> is_subject aag (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) \<and> (case pde_ref2 (PageTablePDE (addrFromPPtr word) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) of None \<Rightarrow> True | Some x2 \<Rightarrow> is_subject aag (fst x2)) \<and> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word (Some (x, msg ! 0 && ~~ mask 20)))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word option)) \<and> ((\<exists>asid vspace_ref. option = Some (asid, vspace_ref)) \<longrightarrow> (\<forall>x\<in>set [word , word + 4 .e. word + 2 ^ pt_bits - 1]. is_subject aag (x && ~~ mask pt_bits)))) proof (prove)
goal (1 subgoal):
 1. \<And>x2. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageTableCap word option)). (pasSubject aag, auth, pasObjectAbs aag word) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageTableCap word option)); is_subject aag (fst slot); \<forall>v\<in>set_option option. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap word option); cap = PageTableCap word option; invocation_type label = ArchInvocationLabel x2\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> option = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> is_subject aag (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) \<and> (case pde_ref2 (PageTablePDE (addrFromPPtr word) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) of None \<Rightarrow> True | Some x2 \<Rightarrow> is_subject aag (fst x2)) \<and> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word (Some (x, msg ! 0 && ~~ mask 20)))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word option)) \<and> ((\<exists>asid vspace_ref. option = Some (asid, vspace_ref)) \<longrightarrow> (\<forall>x\<in>set [word , word + 4 .e. word + 2 ^ pt_bits - 1]. is_subject aag (x && ~~ mask pt_bits)))) proof (prove)
goal (1 subgoal):
 1. \<And>archlabel. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageTableCap word option)). (pasSubject aag, auth, pasObjectAbs aag word) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageTableCap word option)); is_subject aag (fst slot); \<forall>v\<in>set_option option. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap word option); cap = PageTableCap word option; invocation_type label = ArchInvocationLabel archlabel\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> option = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> is_subject aag (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) \<and> (case pde_ref2 (PageTablePDE (addrFromPPtr word) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) of None \<Rightarrow> True | Some x2 \<Rightarrow> is_subject aag (fst x2)) \<and> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word (Some (x, msg ! 0 && ~~ mask 20)))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word option)) \<and> ((\<exists>asid vspace_ref. option = Some (asid, vspace_ref)) \<longrightarrow> (\<forall>x\<in>set [word , word + 4 .e. word + 2 ^ pt_bits - 1]. is_subject aag (x && ~~ mask pt_bits)))) proof (prove)
goal (2 subgoals):
 1. \<And>archlabel. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageTableCap word option)). (pasSubject aag, auth, pasObjectAbs aag word) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageTableCap word option)); is_subject aag (fst slot); \<forall>v\<in>set_option option. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap word option); cap = PageTableCap word option; invocation_type label = ArchInvocationLabel archlabel; archlabel = ARMPageTableMap\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> option = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> is_subject aag (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) \<and> (case pde_ref2 (PageTablePDE (addrFromPPtr word) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) of None \<Rightarrow> True | Some x2 \<Rightarrow> is_subject aag (fst x2)) \<and> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word (Some (x, msg ! 0 && ~~ mask 20)))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word option)) \<and> ((\<exists>asid vspace_ref. option = Some (asid, vspace_ref)) \<longrightarrow> (\<forall>x\<in>set [word , word + 4 .e. word + 2 ^ pt_bits - 1]. is_subject aag (x && ~~ mask pt_bits))))
 2. \<And>archlabel. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageTableCap word option)). (pasSubject aag, auth, pasObjectAbs aag word) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageTableCap word option)); is_subject aag (fst slot); \<forall>v\<in>set_option option. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap word option); cap = PageTableCap word option; invocation_type label = ArchInvocationLabel archlabel; archlabel = ARMPageTableUnmap\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> option = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> is_subject aag (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) \<and> (case pde_ref2 (PageTablePDE (addrFromPPtr word) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) of None \<Rightarrow> True | Some x2 \<Rightarrow> is_subject aag (fst x2)) \<and> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word (Some (x, msg ! 0 && ~~ mask 20)))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word option)) \<and> ((\<exists>asid vspace_ref. option = Some (asid, vspace_ref)) \<longrightarrow> (\<forall>x\<in>set [word , word + 4 .e. word + 2 ^ pt_bits - 1]. is_subject aag (x && ~~ mask pt_bits)))) proof (prove)
goal (2 subgoals):
 1. \<And>archlabel. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageTableCap word option)). (pasSubject aag, auth, pasObjectAbs aag word) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageTableCap word option)); is_subject aag (fst slot); \<forall>v\<in>set_option option. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap word option); cap = PageTableCap word option; invocation_type label = ArchInvocationLabel archlabel; archlabel = ARMPageTableMap\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> option = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> is_subject aag (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) \<and> (case pde_ref2 (PageTablePDE (addrFromPPtr word) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) of None \<Rightarrow> True | Some x2 \<Rightarrow> is_subject aag (fst x2)) \<and> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word (Some (x, msg ! 0 && ~~ mask 20)))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word option)) \<and> ((\<exists>asid vspace_ref. option = Some (asid, vspace_ref)) \<longrightarrow> (\<forall>x\<in>set [word , word + 4 .e. word + 2 ^ pt_bits - 1]. is_subject aag (x && ~~ mask pt_bits))))
 2. \<And>archlabel. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageTableCap word option)). (pasSubject aag, auth, pasObjectAbs aag word) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageTableCap word option)); is_subject aag (fst slot); \<forall>v\<in>set_option option. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap word option); cap = PageTableCap word option; invocation_type label = ArchInvocationLabel archlabel; archlabel = ARMPageTableUnmap\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> option = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> is_subject aag (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) \<and> (case pde_ref2 (PageTablePDE (addrFromPPtr word) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) of None \<Rightarrow> True | Some x2 \<Rightarrow> is_subject aag (fst x2)) \<and> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word (Some (x, msg ! 0 && ~~ mask 20)))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word option)) \<and> ((\<exists>asid vspace_ref. option = Some (asid, vspace_ref)) \<longrightarrow> (\<forall>x\<in>set [word , word + 4 .e. word + 2 ^ pt_bits - 1]. is_subject aag (x && ~~ mask pt_bits)))) proof (prove)
goal (1 subgoal):
 1. \<And>archlabel. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageTableCap word option)). (pasSubject aag, auth, pasObjectAbs aag word) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageTableCap word option)); is_subject aag (fst slot); \<forall>v\<in>set_option option. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap word option); cap = PageTableCap word option; invocation_type label = ArchInvocationLabel archlabel; archlabel = ARMPageTableUnmap\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> option = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> is_subject aag (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) \<and> (case pde_ref2 (PageTablePDE (addrFromPPtr word) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) of None \<Rightarrow> True | Some x2 \<Rightarrow> is_subject aag (fst x2)) \<and> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word (Some (x, msg ! 0 && ~~ mask 20)))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word option)) \<and> ((\<exists>asid vspace_ref. option = Some (asid, vspace_ref)) \<longrightarrow> (\<forall>x\<in>set [word , word + 4 .e. word + 2 ^ pt_bits - 1]. is_subject aag (x && ~~ mask pt_bits)))) proof (prove)
goal (1 subgoal):
 1. \<And>archlabel. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageTableCap word option)). (pasSubject aag, auth, pasObjectAbs aag word) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageTableCap word option)); is_subject aag (fst slot); \<forall>v\<in>set_option option. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap word option); cap = PageTableCap word option; invocation_type label = ArchInvocationLabel archlabel; archlabel = ARMPageTableUnmap\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> option = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> is_subject aag (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) \<and> (case pde_ref2 (PageTablePDE (addrFromPPtr word) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) of None \<Rightarrow> True | Some x2 \<Rightarrow> is_subject aag (fst x2)) \<and> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word (Some (x, msg ! 0 && ~~ mask 20)))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word option)) \<and> ((\<exists>asid vspace_ref. option = Some (asid, vspace_ref)) \<longrightarrow> (\<forall>x\<in>set [word , word + 4 .e. word + 2 ^ pt_bits - 1]. is_subject aag (x && ~~ mask pt_bits)))) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<forall>auth\<in>cap_auth_conferred (ArchObjectCap (PageTableCap word option)). (pasSubject aag, auth, pasObjectAbs aag word) \<in> pasPolicy aag; cap_links_asid_slot aag (pasSubject aag) (ArchObjectCap (PageTableCap word option)); is_subject aag (fst slot); \<forall>v\<in>set_option option. is_subject_asid aag (fst v); \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>cap_auth_conferred cap. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> cap_links_asid_slot aag (pasObjectAbs aag (fst slot)) cap \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap word option); cap = PageTableCap word option; invocation_type label = ArchInvocationLabel archlabel_; archlabel_ = ARMPageTableUnmap\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> option = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> is_subject aag (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) \<and> (case pde_ref2 (PageTablePDE (addrFromPPtr word) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) of None \<Rightarrow> True | Some x2 \<Rightarrow> is_subject aag (fst x2)) \<and> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word (Some (x, msg ! 0 && ~~ mask 20)))))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> pas_cap_cur_auth aag (ArchObjectCap (PageTableCap word option)) \<and> ((\<exists>asid vspace_ref. option = Some (asid, vspace_ref)) \<longrightarrow> (\<forall>x\<in>set [word , word + 4 .e. word + 2 ^ pt_bits - 1]. is_subject aag (x && ~~ mask pt_bits)))) proof (prove)
goal (1 subgoal):
 1. \<And>x asid vspace_ref. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref m r \<Rightarrow> reply_cap_rights_to_auth m r | ArchObjectCap arch_cap \<Rightarrow> arch_cap_auth_conferred arch_cap | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>asid\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) asid) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap word (Some (asid, vspace_ref))); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; x \<in> set [word , word + 4 .e. word + 2 ^ pt_bits - 1]; option = Some (asid, vspace_ref)\<rbrakk> \<Longrightarrow> is_subject aag (x && ~~ mask pt_bits) proof (prove)
goal (2 subgoals):
 1. \<And>x asid vspace_ref. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref m r \<Rightarrow> reply_cap_rights_to_auth m r | ArchObjectCap arch_cap \<Rightarrow> arch_cap_auth_conferred arch_cap | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>asid\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) asid) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap word (Some (asid, vspace_ref))); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; x \<in> set [word , word + 4 .e. word + 2 ^ pt_bits - 1]; option = Some (asid, vspace_ref); x && ~~ mask pt_bits = word\<rbrakk> \<Longrightarrow> is_subject aag (x && ~~ mask pt_bits)
 2. \<And>x asid vspace_ref. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref m r \<Rightarrow> reply_cap_rights_to_auth m r | ArchObjectCap arch_cap \<Rightarrow> arch_cap_auth_conferred arch_cap | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>asid\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) asid) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap word (Some (asid, vspace_ref))); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; x \<in> set [word , word + 4 .e. word + 2 ^ pt_bits - 1]; option = Some (asid, vspace_ref)\<rbrakk> \<Longrightarrow> x && ~~ mask pt_bits = word proof (prove)
goal (1 subgoal):
 1. \<And>x asid vspace_ref. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref m r \<Rightarrow> reply_cap_rights_to_auth m r | ArchObjectCap arch_cap \<Rightarrow> arch_cap_auth_conferred arch_cap | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>asid\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) asid) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); s \<turnstile> ArchObjectCap (PageTableCap word (Some (asid, vspace_ref))); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; x \<in> set [word , word + 4 .e. word + 2 ^ pt_bits - 1]; option = Some (asid, vspace_ref)\<rbrakk> \<Longrightarrow> x && ~~ mask pt_bits = word proof (prove)
goal (1 subgoal):
 1. \<And>x asid vspace_ref. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref m r \<Rightarrow> reply_cap_rights_to_auth m r | ArchObjectCap arch_cap \<Rightarrow> arch_cap_auth_conferred arch_cap | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>asid\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) asid) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; x \<in> set [word , word + 4 .e. word + 2 ^ pt_bits - 1]; option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20\<rbrakk> \<Longrightarrow> x && ~~ mask pt_bits = word proof (prove)
goal (2 subgoals):
 1. \<And>x asid vspace_ref. \<lbrakk>option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20; invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref m r \<Rightarrow> reply_cap_rights_to_auth m r | ArchObjectCap arch_cap \<Rightarrow> arch_cap_auth_conferred arch_cap | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>asid\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) asid) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap\<rbrakk> \<Longrightarrow> word \<le> word + 2 ^ pt_bits - 1
 2. \<And>x asid vspace_ref. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref m r \<Rightarrow> reply_cap_rights_to_auth m r | ArchObjectCap arch_cap \<Rightarrow> arch_cap_auth_conferred arch_cap | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>asid\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) asid) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; x \<in> set (map ((+) word) [0 , word + 4 - word .e. word + 2 ^ pt_bits - 1 - word]); option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20\<rbrakk> \<Longrightarrow> x && ~~ mask pt_bits = word proof (prove)
goal (3 subgoals):
 1. \<And>x asid vspace_ref. \<lbrakk>option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20; invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref m r \<Rightarrow> reply_cap_rights_to_auth m r | ArchObjectCap arch_cap \<Rightarrow> arch_cap_auth_conferred arch_cap | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>asid\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) asid) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; is_aligned word pt_bits\<rbrakk> \<Longrightarrow> word \<le> word + 2 ^ pt_bits - 1
 2. \<And>x asid vspace_ref. \<lbrakk>option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20; invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref m r \<Rightarrow> reply_cap_rights_to_auth m r | ArchObjectCap arch_cap \<Rightarrow> arch_cap_auth_conferred arch_cap | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>asid\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) asid) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap\<rbrakk> \<Longrightarrow> is_aligned word pt_bits
 3. \<And>x asid vspace_ref. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref m r \<Rightarrow> reply_cap_rights_to_auth m r | ArchObjectCap arch_cap \<Rightarrow> arch_cap_auth_conferred arch_cap | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>asid\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) asid) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; x \<in> set (map ((+) word) [0 , word + 4 - word .e. word + 2 ^ pt_bits - 1 - word]); option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20\<rbrakk> \<Longrightarrow> x && ~~ mask pt_bits = word proof (prove)
goal (2 subgoals):
 1. \<And>x asid vspace_ref. \<lbrakk>option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20; invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref m r \<Rightarrow> reply_cap_rights_to_auth m r | ArchObjectCap arch_cap \<Rightarrow> arch_cap_auth_conferred arch_cap | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>asid\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) asid) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap\<rbrakk> \<Longrightarrow> is_aligned word pt_bits
 2. \<And>x asid vspace_ref. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref m r \<Rightarrow> reply_cap_rights_to_auth m r | ArchObjectCap arch_cap \<Rightarrow> arch_cap_auth_conferred arch_cap | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>asid\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) asid) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; x \<in> set (map ((+) word) [0 , word + 4 - word .e. word + 2 ^ pt_bits - 1 - word]); option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20\<rbrakk> \<Longrightarrow> x && ~~ mask pt_bits = word proof (prove)
goal (1 subgoal):
 1. \<And>x asid vspace_ref. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref m r \<Rightarrow> reply_cap_rights_to_auth m r | ArchObjectCap arch_cap \<Rightarrow> arch_cap_auth_conferred arch_cap | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>asid\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) asid) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; x \<in> set (map ((+) word) [0 , word + 4 - word .e. word + 2 ^ pt_bits - 1 - word]); option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20\<rbrakk> \<Longrightarrow> x && ~~ mask pt_bits = word proof (prove)
goal (1 subgoal):
 1. \<And>x asid vspace_ref. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref m r \<Rightarrow> reply_cap_rights_to_auth m r | ArchObjectCap arch_cap \<Rightarrow> arch_cap_auth_conferred arch_cap | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>asid\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) asid) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; x \<in> (+) word ` set [0 , 4 .e. 2 ^ pt_bits - 1]; option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20\<rbrakk> \<Longrightarrow> x && ~~ mask pt_bits = word proof (prove)
goal (3 subgoals):
 1. \<And>x asid vspace_ref. \<lbrakk>option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20; invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref m r \<Rightarrow> reply_cap_rights_to_auth m r | ArchObjectCap arch_cap \<Rightarrow> arch_cap_auth_conferred arch_cap | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>asid\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) asid) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap\<rbrakk> \<Longrightarrow> pt_bits < LENGTH(32)
 2. \<And>x asid vspace_ref. \<lbrakk>option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20; invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref m r \<Rightarrow> reply_cap_rights_to_auth m r | ArchObjectCap arch_cap \<Rightarrow> arch_cap_auth_conferred arch_cap | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>asid\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) asid) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap\<rbrakk> \<Longrightarrow> 2 \<le> pt_bits
 3. \<And>x asid vspace_ref. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref m r \<Rightarrow> reply_cap_rights_to_auth m r | ArchObjectCap arch_cap \<Rightarrow> arch_cap_auth_conferred arch_cap | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>asid\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) asid) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; x \<in> (+) word ` set (map (\<lambda>x. word_of_nat x * 4) [0..<2 ^ (pt_bits - 2)]); option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20\<rbrakk> \<Longrightarrow> x && ~~ mask pt_bits = word proof (prove)
goal (2 subgoals):
 1. \<And>x asid vspace_ref. \<lbrakk>option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20; invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref m r \<Rightarrow> reply_cap_rights_to_auth m r | ArchObjectCap arch_cap \<Rightarrow> arch_cap_auth_conferred arch_cap | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>asid\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) asid) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap\<rbrakk> \<Longrightarrow> 2 \<le> pt_bits
 2. \<And>x asid vspace_ref. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref m r \<Rightarrow> reply_cap_rights_to_auth m r | ArchObjectCap arch_cap \<Rightarrow> arch_cap_auth_conferred arch_cap | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>asid\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) asid) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; x \<in> (+) word ` set (map (\<lambda>x. word_of_nat x * 4) [0..<2 ^ (pt_bits - 2)]); option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20\<rbrakk> \<Longrightarrow> x && ~~ mask pt_bits = word proof (prove)
goal (1 subgoal):
 1. \<And>x asid vspace_ref. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref m r \<Rightarrow> reply_cap_rights_to_auth m r | ArchObjectCap arch_cap \<Rightarrow> arch_cap_auth_conferred arch_cap | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>asid\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) asid) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; x \<in> (+) word ` set (map (\<lambda>x. word_of_nat x * 4) [0..<2 ^ (pt_bits - 2)]); option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20\<rbrakk> \<Longrightarrow> x && ~~ mask pt_bits = word proof (prove)
goal (1 subgoal):
 1. \<And>asid vspace_ref xb. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref x xa \<Rightarrow> reply_cap_rights_to_auth x xa | ArchObjectCap x \<Rightarrow> arch_cap_auth_conferred x | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) x) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20; xb < 2 ^ (pt_bits - 2)\<rbrakk> \<Longrightarrow> word + word_of_nat xb * 4 && ~~ mask pt_bits = word proof (prove)
goal (3 subgoals):
 1. \<And>asid vspace_ref xb. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref x xa \<Rightarrow> reply_cap_rights_to_auth x xa | ArchObjectCap x \<Rightarrow> arch_cap_auth_conferred x | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) x) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20; xb < 2 ^ (pt_bits - 2)\<rbrakk> \<Longrightarrow> is_aligned word pt_bits
 2. \<And>asid vspace_ref xb. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref x xa \<Rightarrow> reply_cap_rights_to_auth x xa | ArchObjectCap x \<Rightarrow> arch_cap_auth_conferred x | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) x) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20; xb < 2 ^ (pt_bits - 2)\<rbrakk> \<Longrightarrow> word_of_nat xb * 4 < 2 ^ pt_bits
 3. \<And>asid vspace_ref xb. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref x xa \<Rightarrow> reply_cap_rights_to_auth x xa | ArchObjectCap x \<Rightarrow> arch_cap_auth_conferred x | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) x) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20; xb < 2 ^ (pt_bits - 2)\<rbrakk> \<Longrightarrow> word = word proof (prove)
goal (2 subgoals):
 1. \<And>asid vspace_ref xb. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref x xa \<Rightarrow> reply_cap_rights_to_auth x xa | ArchObjectCap x \<Rightarrow> arch_cap_auth_conferred x | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) x) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20; xb < 2 ^ (pt_bits - 2)\<rbrakk> \<Longrightarrow> word_of_nat xb * 4 < 2 ^ pt_bits
 2. \<And>asid vspace_ref xb. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref x xa \<Rightarrow> reply_cap_rights_to_auth x xa | ArchObjectCap x \<Rightarrow> arch_cap_auth_conferred x | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) x) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20; xb < 2 ^ (pt_bits - 2)\<rbrakk> \<Longrightarrow> word = word proof (prove)
goal (3 subgoals):
 1. \<And>asid vspace_ref xb. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref x xa \<Rightarrow> reply_cap_rights_to_auth x xa | ArchObjectCap x \<Rightarrow> arch_cap_auth_conferred x | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) x) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20\<rbrakk> \<Longrightarrow> 2 \<le> pt_bits
 2. \<And>asid vspace_ref xb. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref x xa \<Rightarrow> reply_cap_rights_to_auth x xa | ArchObjectCap x \<Rightarrow> arch_cap_auth_conferred x | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) x) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20\<rbrakk> \<Longrightarrow> pt_bits < LENGTH(32)
 3. \<And>asid vspace_ref xb. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref x xa \<Rightarrow> reply_cap_rights_to_auth x xa | ArchObjectCap x \<Rightarrow> arch_cap_auth_conferred x | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) x) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20; xb < 2 ^ (pt_bits - 2)\<rbrakk> \<Longrightarrow> word = word proof (prove)
goal (2 subgoals):
 1. \<And>asid vspace_ref xb. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref x xa \<Rightarrow> reply_cap_rights_to_auth x xa | ArchObjectCap x \<Rightarrow> arch_cap_auth_conferred x | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) x) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20\<rbrakk> \<Longrightarrow> pt_bits < LENGTH(32)
 2. \<And>asid vspace_ref xb. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref x xa \<Rightarrow> reply_cap_rights_to_auth x xa | ArchObjectCap x \<Rightarrow> arch_cap_auth_conferred x | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) x) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20; xb < 2 ^ (pt_bits - 2)\<rbrakk> \<Longrightarrow> word = word proof (prove)
goal (1 subgoal):
 1. \<And>asid vspace_ref xb. \<lbrakk>invs s; pas_refined aag s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; is_subject aag word; label_owns_asid_slot aag (pasSubject aag) asid; is_subject aag (fst slot); is_subject_asid aag asid; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> (\<forall>x\<in>obj_refs_ac cap. \<forall>auth\<in>case cap of NullCap \<Rightarrow> {} | EndpointCap oref badge r \<Rightarrow> cap_rights_to_auth r True | NotificationCap oref badge r \<Rightarrow> cap_rights_to_auth (r - {AllowGrant, AllowGrantReply}) False | ReplyCap oref x xa \<Rightarrow> reply_cap_rights_to_auth x xa | ArchObjectCap x \<Rightarrow> arch_cap_auth_conferred x | _ \<Rightarrow> {Control}. (pasObjectAbs aag (fst slot), auth, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>untyped_range cap. (pasObjectAbs aag (fst slot), Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (\<forall>x\<in>cap_asid' cap. label_owns_asid_slot aag (pasObjectAbs aag (fst slot)) x) \<and> cap_links_irq aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); cap = PageTableCap word (Some (asid, vspace_ref)); invocation_type label = ArchInvocationLabel ARMPageTableUnmap; archlabel_ = ARMPageTableUnmap; option = Some (asid, vspace_ref); is_aligned word 10; 10 < word_bits; typ_at (AArch APageTable) word s; 0 < asid; asid < 2 ^ local.asid_bits; vspace_ref < kernel_base; is_aligned vspace_ref 20; xb < 2 ^ (pt_bits - 2)\<rbrakk> \<Longrightarrow> word = word proof (prove)
goal:
No subgoals! proof (prove)
goal:
No subgoals! proof (prove)
goal:
No subgoals!