theory Arch_DR

lemma invoke_page_corres:
  "transform_page_inv ip' = Some ip  \<Longrightarrow>
   dcorres dc \<top> (valid_page_inv ip' and invs and page_inv_duplicates_valid ip' and valid_pdpt_objs and valid_etcbs and ct_active)
    (invoke_page ip) (perform_page_invocation ip')" supply if_cong[cong] apply (clarsimp simp:invoke_page_def) apply (case_tac ip') apply (simp_all add:perform_page_invocation_def) apply (rename_tac word cap prod sum) apply (simp_all add:perform_page_invocation_def transform_page_inv_def) apply (rule dcorres_expand_pfx) apply (clarsimp simp:valid_page_inv_def) apply (clarsimp simp:empty_refs_def) apply (case_tac sum) apply (clarsimp simp: mapM_x_singleton) apply (simp add:page_inv_duplicates_valid_def split:if_splits) apply (rule corres_guard_imp) apply (rule corres_split) apply (rule set_cap_corres; simp) apply (rule corres_bind_return_r, rule corres_rel_imp[rotated], simp) apply (rule corres_dummy_return_pl[where b ="()"]) apply (rule corres_split[OF pte_check_if_mapped_corres]) apply (simp split del: if_split) apply (rule corres_dummy_return_l) apply (rule corres_split) apply (rule store_pte_set_cap_corres; simp) apply (rule corres_dummy_return_l) apply (rule_tac corres_split[OF dcorres_store_invalid_pte_tail_large_page]) apply (rule corres_dummy_return_l) apply (rule corres_split[OF _ if_invalidate_equiv_return]) apply (rule wp_to_dcorres[where Q=\<top>]) apply (wp do_machine_op_wp mapM_wp' set_cap_idle
                           store_pte_page_inv_entries_safe set_cap_page_inv_entries_safe
                        | clarsimp simp:cleanCacheRange_PoU_def)+ apply (clarsimp simp:invs_def valid_state_def cte_wp_at_caps_of_state) apply (frule_tac v = b in valid_idle_has_null_cap,simp+) apply (clarsimp simp:is_arch_update_def is_arch_cap_def cap_master_cap_def split:cap.split_asm) apply (clarsimp simp:mapM_x_singleton) apply (rule corres_guard_imp) apply (rule corres_split) apply (rule set_cap_corres; simp) apply (rule corres_bind_return_r, rule corres_rel_imp[rotated], simp) apply (rule corres_dummy_return_pl[where b="()"]) apply (rule corres_split[OF pde_check_if_mapped_corres]) apply (simp split del: if_split) apply (rule corres_dummy_return_l) apply (rule corres_split) apply (rule store_pde_set_cap_corres; clarsimp simp: valid_slots_def) apply (rule corres_dummy_return_l) apply (rule_tac corres_split[OF dcorres_store_invalid_pde_tail_super_section]) apply (rule corres_dummy_return_l) apply (rule corres_split[OF _ if_invalidate_equiv_return]) apply (rule wp_to_dcorres[where Q=\<top>]) apply (wp do_machine_op_wp mapM_wp' set_cap_idle
                          set_cap_page_inv_entries_safe store_pde_page_inv_entries_safe
                       | clarsimp simp:cleanCacheRange_PoU_def)+ apply (simp add:page_inv_duplicates_valid_def valid_slots_def
                    page_inv_entries_safe_def split:if_splits) apply (clarsimp simp:invs_def valid_state_def cte_wp_at_caps_of_state) apply (frule_tac v = b in valid_idle_has_null_cap,simp+) apply (clarsimp simp:is_arch_update_def is_arch_cap_def cap_master_cap_def split:cap.split_asm) apply (clarsimp simp:invs_def valid_state_def cte_wp_at_caps_of_state) apply (frule_tac v = b in valid_idle_has_null_cap,simp+) apply (clarsimp simp:is_arch_update_def is_arch_cap_def cap_master_cap_def split:cap.split_asm)

   \<comment> \<open>PageUnmap\<close> apply (rule dcorres_expand_pfx) apply (clarsimp simp: valid_page_inv_def transform_mapping_def liftM_def
     split:arch_cap.splits option.splits) apply (rule corres_guard_imp) apply (rule corres_split) apply (rule get_cap_corres; simp) apply (rule corres_bind_return_r, rule corres_rel_imp[rotated], simp) apply (rule_tac P="\<lambda>y s. cte_wp_at ((=) x) (a,b) s \<and> s = s'" in set_cap_corres_stronger) apply clarsimp apply (drule cte_wp_at_eqD2, simp) apply (clarsimp simp: transform_mapping_def update_map_data_def) apply (wp get_cap_cte_wp_at_rv | clarsimp)+ apply (clarsimp simp:cte_wp_at_def is_arch_cap_def is_pt_cap_def) apply (clarsimp simp:invs_def valid_state_def not_idle_thread_def) apply (frule valid_idle_has_null_cap,simp+) apply (rule sym) apply (simp add:get_cap_caps_of_state)+ apply (rule corres_guard_imp) apply (rule corres_split[OF dcorres_unmap_page]) apply (rule corres_split) apply (rule get_cap_corres; simp) apply (rule corres_bind_return_r, rule corres_rel_imp[rotated], simp) apply (rule_tac P="\<lambda>y s. cte_wp_at ((=) x) (a,b) s \<and>
                                   caps_of_state s' = caps_of_state s"
           in set_cap_corres_stronger) apply (clarsimp simp:cte_wp_at_caps_of_state) apply (clarsimp simp: transform_mapping_def update_map_data_def) apply (wp get_cap_cte_wp_at_rv unmap_page_pred_tcb_at |
                clarsimp simp:valid_idle_def not_idle_thread_def)+ apply (rule_tac Q="\<lambda>rv s. valid_etcbs s \<and>
                               idle_tcb_at (\<lambda>(st, ntfn, arch). idle st \<and> ntfn = None \<and> valid_arch_idle arch)
                                           (idle_thread s) s \<and>
                               a \<noteq> idle_thread s \<and> idle_thread s = idle_thread_ptr \<and> cte_wp_at \<top> (a,b) s \<and>
                               caps_of_state s' = caps_of_state s" in hoare_strengthen_post) apply (wps, wp unmap_page_pred_tcb_at, clarsimp simp: invs_def valid_state_def valid_idle_def) apply simp apply (clarsimp simp: cte_wp_at_def is_arch_cap_def is_pt_cap_def) apply (rule conjI, simp) apply (rule conjI, simp add:invs_def valid_state_def valid_idle_def) apply (clarsimp simp:invs_def valid_state_def not_idle_thread_def) apply (clarsimp simp:invs_def valid_state_def not_idle_thread_def valid_idle_def) apply (frule valid_idle_has_null_cap, (simp add: valid_idle_def)+) apply (rule sym) apply (simp add:get_cap_caps_of_state)+

  \<comment> \<open>PageFlush\<close> apply (clarsimp simp:invoke_page_def) apply (clarsimp simp: when_def split: if_splits) apply (rule corres_bind_return_r, rule corres_rel_imp[rotated], simp) apply (rule corres_guard_imp) apply (rule dcorres_symb_exec_r)+ apply (simp only: if_split_asm) apply (safe) apply (erule notE) apply (rule dcorres_symb_exec_r)+ apply (rule dcorres_set_vm_root) apply (wp)+ apply (erule notE)+ apply (clarsimp) apply (wp do_machine_op_wp | clarsimp)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. transform_page_inv ip' = Some ip \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv ip' and invs and page_inv_duplicates_valid ip' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (invoke_page ip) (perform_page_invocation ip') proof (prove)
goal (1 subgoal):
 1. transform_page_inv ip' = Some ip \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv ip' and invs and page_inv_duplicates_valid ip' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (invoke_page ip) (perform_page_invocation ip') proof (prove)
goal (1 subgoal):
 1. transform_page_inv ip' = Some ip \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv ip' and invs and page_inv_duplicates_valid ip' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (perform_page_invocation ip') proof (prove)
goal (4 subgoals):
 1. \<And>x11 x12 x13 x14. \<lbrakk>transform_page_inv ip' = Some ip; ip' = page_invocation.PageMap x11 x12 x13 x14\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv ip' and invs and page_inv_duplicates_valid ip' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (perform_page_invocation ip')
 2. \<And>x21 x22. \<lbrakk>transform_page_inv ip' = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv ip' and invs and page_inv_duplicates_valid ip' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (perform_page_invocation ip')
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>transform_page_inv ip' = Some ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv ip' and invs and page_inv_duplicates_valid ip' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (perform_page_invocation ip')
 4. \<And>x4. \<lbrakk>transform_page_inv ip' = Some ip; ip' = PageGetAddr x4\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv ip' and invs and page_inv_duplicates_valid ip' and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (perform_page_invocation ip') proof (prove)
goal (4 subgoals):
 1. \<And>x11 x12 x13 x14. \<lbrakk>transform_page_inv (page_invocation.PageMap x11 x12 x13 x14) = Some ip; ip' = page_invocation.PageMap x11 x12 x13 x14\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageMap x11 x12 x13 x14) and invs and page_inv_duplicates_valid (page_invocation.PageMap x11 x12 x13 x14) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- CSpaceAcc_A.set_cap x12 x13;
y <- case x14 of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid x11 else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid x11 else return ()
od;
return []
od)
 2. \<And>x21 x22. \<lbrakk>transform_page_inv (page_invocation.PageUnmap x21 x22) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>transform_page_inv (PageFlush x31 x32 x33 x34 x35 x36) = Some ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od)
 4. \<And>x4. \<lbrakk>transform_page_inv (PageGetAddr x4) = Some ip; ip' = PageGetAddr x4\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageGetAddr x4) and invs and page_inv_duplicates_valid (PageGetAddr x4) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (return [addrFromPPtr x4]) proof (prove)
goal (4 subgoals):
 1. \<And>word cap prod sum. \<lbrakk>transform_page_inv (page_invocation.PageMap word cap prod sum) = Some ip; ip' = page_invocation.PageMap word cap prod sum\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageMap word cap prod sum) and invs and page_inv_duplicates_valid (page_invocation.PageMap word cap prod sum) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- CSpaceAcc_A.set_cap cap prod;
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 2. \<And>x21 x22. \<lbrakk>transform_page_inv (page_invocation.PageUnmap x21 x22) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>transform_page_inv (PageFlush x31 x32 x33 x34 x35 x36) = Some ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od)
 4. \<And>x4. \<lbrakk>transform_page_inv (PageGetAddr x4) = Some ip; ip' = PageGetAddr x4\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageGetAddr x4) and invs and page_inv_duplicates_valid (PageGetAddr x4) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (return [addrFromPPtr x4]) proof (prove)
goal (3 subgoals):
 1. \<And>word cap prod sum. \<lbrakk>cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr prod) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) = ip; ip' = page_invocation.PageMap word cap prod sum\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageMap word cap prod sum) and invs and page_inv_duplicates_valid (page_invocation.PageMap word cap prod sum) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- CSpaceAcc_A.set_cap cap prod;
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 2. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (3 subgoals):
 1. \<And>word cap prod sum s s'. \<lbrakk>cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr prod) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) = ip; ip' = page_invocation.PageMap word cap prod sum; s = transform s'; True; (valid_page_inv (page_invocation.PageMap word cap prod sum) and invs and page_inv_duplicates_valid (page_invocation.PageMap word cap prod sum) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s') (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- CSpaceAcc_A.set_cap cap prod;
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 2. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (3 subgoals):
 1. \<And>word cap a b sum s' aa ba pd. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) sum; ip = cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr (a, b)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]); cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs sum c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs sum cap s'; valid_slots sum s'; s' \<turnstile> cap; is_pg_cap cap; empty_refs sum; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs sum) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) sum) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
mapM_x (swp KHeap_D.set_cap (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 2. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (3 subgoals):
 1. \<And>word cap a b sum s' aa ba pd. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) sum; ip = cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr (a, b)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]); cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs sum c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs sum cap s'; valid_slots sum s'; s' \<turnstile> cap; is_pg_cap cap; \<forall>a. (\<exists>b. sum = Inr (a, b)) \<longrightarrow> pde_ref a = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs sum) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) sum) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
mapM_x (swp KHeap_D.set_cap (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 2. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (4 subgoals):
 1. \<And>word cap a b sum s' aa ba pd ab. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) sum; ip = cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr (a, b)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]); cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs sum c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs sum cap s'; valid_slots sum s'; s' \<turnstile> cap; is_pg_cap cap; \<forall>a. (\<exists>b. sum = Inr (a, b)) \<longrightarrow> pde_ref a = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs sum) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) sum) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; sum = Inl ab\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
mapM_x (swp KHeap_D.set_cap (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 2. \<And>word cap a b sum s' aa ba pd bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) sum; ip = cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr (a, b)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]); cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs sum c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs sum cap s'; valid_slots sum s'; s' \<turnstile> cap; is_pg_cap cap; \<forall>a. (\<exists>b. sum = Inr (a, b)) \<longrightarrow> pde_ref a = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs sum) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) sum) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; sum = Inr bb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
mapM_x (swp KHeap_D.set_cap (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 3. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (4 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inl (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
KHeap_D.set_cap (transform_pt_slot_ref (hd bb)) (transform_pte ab)
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- do flush <- pte_check_if_mapped (hd bb);
y <- store_pte (hd bb) ab;
y <- mapM (swp store_pte InvalidPTE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pte (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 2. \<And>word cap a b sum s' aa ba pd bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) sum; ip = cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr (a, b)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]); cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs sum c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs sum cap s'; valid_slots sum s'; s' \<turnstile> cap; is_pg_cap cap; \<forall>a. (\<exists>b. sum = Inr (a, b)) \<longrightarrow> pde_ref a = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs sum) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) sum) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; sum = Inr bb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
mapM_x (swp KHeap_D.set_cap (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 3. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (4 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
KHeap_D.set_cap (transform_pt_slot_ref (hd bb)) (transform_pte ab)
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- do flush <- pte_check_if_mapped (hd bb);
y <- store_pte (hd bb) ab;
y <- mapM (swp store_pte InvalidPTE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pte (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 2. \<And>word cap a b sum s' aa ba pd bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) sum; ip = cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr (a, b)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]); cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs sum c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs sum cap s'; valid_slots sum s'; s' \<turnstile> cap; is_pg_cap cap; \<forall>a. (\<exists>b. sum = Inr (a, b)) \<longrightarrow> pde_ref a = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs sum) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) sum) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; sum = Inr bb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
mapM_x (swp KHeap_D.set_cap (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 3. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (6 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> dcorres dc (?Q47 word cap a b s' aa ba pd ab bb) (?Q'47 word cap a b s' aa ba pd ab bb) (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
KHeap_D.set_cap (transform_pt_slot_ref (hd bb)) (transform_pte ab)
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- do flush <- pte_check_if_mapped (hd bb);
y <- store_pte (hd bb) ab;
y <- mapM (swp store_pte InvalidPTE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pte (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 2. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ?Q47 word cap a b s' aa ba pd ab bb s
 3. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> ?Q'47 word cap a b s' aa ba pd ab bb s
 4. \<And>word cap a b sum s' aa ba pd bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) sum; ip = cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr (a, b)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]); cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs sum c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs sum cap s'; valid_slots sum s'; s' \<turnstile> cap; is_pg_cap cap; \<forall>a. (\<exists>b. sum = Inr (a, b)) \<longrightarrow> pde_ref a = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs sum) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) sum) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; sum = Inr bb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
mapM_x (swp KHeap_D.set_cap (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 5. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 6. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> dcorres (?r'51 word cap a b s' aa ba pd ab bb) (?P51 word cap a b s' aa ba pd ab bb) (?P'51 word cap a b s' aa ba pd ab bb) (KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap)) (CSpaceAcc_A.set_cap cap (a, b))
 2. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ?r'51 word cap a b s' aa ba pd ab bb y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R51 word cap a b s' aa ba pd ab bb y) (?R'51 word cap a b s' aa ba pd ab bb ya) (KHeap_D.set_cap (transform_pt_slot_ref (hd bb)) (transform_pte ab)) (do y <- do flush <- pte_check_if_mapped (hd bb);
y <- store_pte (hd bb) ab;
y <- mapM (swp store_pte InvalidPTE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pte (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 3. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q51 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>?R51 word cap a b s' aa ba pd ab bb\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>?R'51 word cap a b s' aa ba pd ab bb\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> (?P51 word cap a b s' aa ba pd ab bb and ?Q51 word cap a b s' aa ba pd ab bb) s
 6. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> (?P'51 word cap a b s' aa ba pd ab bb and ?Q'51 word cap a b s' aa ba pd ab bb) s
 7. \<And>word cap a b sum s' aa ba pd bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) sum; ip = cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr (a, b)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]); cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs sum c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs sum cap s'; valid_slots sum s'; s' \<turnstile> cap; is_pg_cap cap; \<forall>a. (\<exists>b. sum = Inr (a, b)) \<longrightarrow> pde_ref a = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs sum) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) sum) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; sum = Inr bb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
mapM_x (swp KHeap_D.set_cap (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 8. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (8 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R51 word cap a b s' aa ba pd ab bb y) (?R'51 word cap a b s' aa ba pd ab bb ya) (KHeap_D.set_cap (transform_pt_slot_ref (hd bb)) (transform_pte ab)) (do y <- do flush <- pte_check_if_mapped (hd bb);
y <- store_pte (hd bb) ab;
y <- mapM (swp store_pte InvalidPTE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pte (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 2. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q51 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>?R51 word cap a b s' aa ba pd ab bb\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>?R'51 word cap a b s' aa ba pd ab bb\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q51 word cap a b s' aa ba pd ab bb) s
 5. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'51 word cap a b s' aa ba pd ab bb) s
 6. \<And>word cap a b sum s' aa ba pd bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) sum; ip = cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr (a, b)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]); cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs sum c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs sum cap s'; valid_slots sum s'; s' \<turnstile> cap; is_pg_cap cap; \<forall>a. (\<exists>b. sum = Inr (a, b)) \<longrightarrow> pde_ref a = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs sum) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) sum) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; sum = Inr bb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
mapM_x (swp KHeap_D.set_cap (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 7. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (8 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> dcorres (?r'67 word cap a b s' aa ba pd ab bb y ya) (?R51 word cap a b s' aa ba pd ab bb y) (?R'51 word cap a b s' aa ba pd ab bb ya) (KHeap_D.set_cap (transform_pt_slot_ref (hd bb)) (transform_pte ab)) (do flush <- pte_check_if_mapped (hd bb);
y <- store_pte (hd bb) ab;
y <- mapM (swp store_pte InvalidPTE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pte (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od)
 2. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q51 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>?R51 word cap a b s' aa ba pd ab bb\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>?R'51 word cap a b s' aa ba pd ab bb\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q51 word cap a b s' aa ba pd ab bb) s
 5. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'51 word cap a b s' aa ba pd ab bb) s
 6. \<And>word cap a b sum s' aa ba pd bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) sum; ip = cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr (a, b)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]); cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs sum c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs sum cap s'; valid_slots sum s'; s' \<turnstile> cap; is_pg_cap cap; \<forall>a. (\<exists>b. sum = Inr (a, b)) \<longrightarrow> pde_ref a = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs sum) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) sum) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; sum = Inr bb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
mapM_x (swp KHeap_D.set_cap (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 7. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (8 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> dcorres (?r'67 word cap a b s' aa ba pd ab bb y ya) (?R51 word cap a b s' aa ba pd ab bb y) (?R'51 word cap a b s' aa ba pd ab bb ya) (do return ();
KHeap_D.set_cap (transform_pt_slot_ref (hd bb)) (transform_pte ab)
od) (do flush <- pte_check_if_mapped (hd bb);
y <- store_pte (hd bb) ab;
y <- mapM (swp store_pte InvalidPTE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pte (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od)
 2. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q51 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>?R51 word cap a b s' aa ba pd ab bb\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>?R'51 word cap a b s' aa ba pd ab bb\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q51 word cap a b s' aa ba pd ab bb) s
 5. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'51 word cap a b s' aa ba pd ab bb) s
 6. \<And>word cap a b sum s' aa ba pd bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) sum; ip = cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr (a, b)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]); cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs sum c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs sum cap s'; valid_slots sum s'; s' \<turnstile> cap; is_pg_cap cap; \<forall>a. (\<exists>b. sum = Inr (a, b)) \<longrightarrow> pde_ref a = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs sum) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) sum) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; sum = Inr bb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
mapM_x (swp KHeap_D.set_cap (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 7. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (10 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb y ya rv flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya; dc rv flush\<rbrakk> \<Longrightarrow> dcorres (?r'67 word cap a b s' aa ba pd ab bb y ya) (?R72 word cap a b s' aa ba pd ab bb y ya rv) (?R'72 word cap a b s' aa ba pd ab bb y ya flush) (K_bind (KHeap_D.set_cap (transform_pt_slot_ref (hd bb)) (transform_pte ab)) rv) (do y <- store_pte (hd bb) ab;
y <- mapM (swp store_pte InvalidPTE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pte (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od)
 2. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q74 word cap a b s' aa ba pd ab bb y\<rbrace> return () \<lbrace>?R72 word cap a b s' aa ba pd ab bb y ya\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b s' aa ba pd ab bb ya\<rbrace> pte_check_if_mapped (hd bb) \<lbrace>?R'72 word cap a b s' aa ba pd ab bb y ya\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q51 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q74 word cap a b s' aa ba pd ab bb y\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q'75 word cap a b s' aa ba pd ab bb ya\<rbrace>
 6. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q51 word cap a b s' aa ba pd ab bb) s
 7. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'51 word cap a b s' aa ba pd ab bb) s
 8. \<And>word cap a b sum s' aa ba pd bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) sum; ip = cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr (a, b)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]); cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs sum c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs sum cap s'; valid_slots sum s'; s' \<turnstile> cap; is_pg_cap cap; \<forall>a. (\<exists>b. sum = Inr (a, b)) \<longrightarrow> pde_ref a = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs sum) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) sum) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; sum = Inr bb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
mapM_x (swp KHeap_D.set_cap (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 9. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 10. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (10 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> dcorres (?r'67 word cap a b s' aa ba pd ab bb () ()) (?R72 word cap a b s' aa ba pd ab bb () () ()) (?R'72 word cap a b s' aa ba pd ab bb () () flush) (KHeap_D.set_cap (transform_pt_slot_ref (hd bb)) (transform_pte ab)) (do y <- store_pte (hd bb) ab;
y <- mapM (swp store_pte InvalidPTE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pte (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od)
 2. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q74 word cap a b s' aa ba pd ab bb y\<rbrace> return () \<lbrace>?R72 word cap a b s' aa ba pd ab bb y ya\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b s' aa ba pd ab bb ya\<rbrace> pte_check_if_mapped (hd bb) \<lbrace>?R'72 word cap a b s' aa ba pd ab bb y ya\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q51 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q74 word cap a b s' aa ba pd ab bb y\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q'75 word cap a b s' aa ba pd ab bb ya\<rbrace>
 6. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q51 word cap a b s' aa ba pd ab bb) s
 7. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'51 word cap a b s' aa ba pd ab bb) s
 8. \<And>word cap a b sum s' aa ba pd bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) sum; ip = cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr (a, b)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]); cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs sum c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs sum cap s'; valid_slots sum s'; s' \<turnstile> cap; is_pg_cap cap; \<forall>a. (\<exists>b. sum = Inr (a, b)) \<longrightarrow> pde_ref a = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs sum) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) sum) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; sum = Inr bb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
mapM_x (swp KHeap_D.set_cap (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 9. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 10. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (10 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> dcorres (?r'67 word cap a b s' aa ba pd ab bb () ()) (?R72 word cap a b s' aa ba pd ab bb () () ()) (?R'72 word cap a b s' aa ba pd ab bb () () flush) (KHeap_D.set_cap (transform_pt_slot_ref (hd bb)) (transform_pte ab) >>= return) (do y <- store_pte (hd bb) ab;
y <- mapM (swp store_pte InvalidPTE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pte (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od)
 2. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q74 word cap a b s' aa ba pd ab bb y\<rbrace> return () \<lbrace>?R72 word cap a b s' aa ba pd ab bb y ya\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b s' aa ba pd ab bb ya\<rbrace> pte_check_if_mapped (hd bb) \<lbrace>?R'72 word cap a b s' aa ba pd ab bb y ya\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q51 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q74 word cap a b s' aa ba pd ab bb y\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q'75 word cap a b s' aa ba pd ab bb ya\<rbrace>
 6. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q51 word cap a b s' aa ba pd ab bb) s
 7. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'51 word cap a b s' aa ba pd ab bb) s
 8. \<And>word cap a b sum s' aa ba pd bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) sum; ip = cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr (a, b)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]); cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs sum c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs sum cap s'; valid_slots sum s'; s' \<turnstile> cap; is_pg_cap cap; \<forall>a. (\<exists>b. sum = Inr (a, b)) \<longrightarrow> pde_ref a = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs sum) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) sum) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; sum = Inr bb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
mapM_x (swp KHeap_D.set_cap (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 9. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 10. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (13 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> dcorres (?r'83 word cap a b s' aa ba pd ab bb flush) (?P93 word cap a b s' aa ba pd ab bb () () ()) (?P'90 word cap a b s' aa ba pd ab bb () () flush) (KHeap_D.set_cap (transform_pt_slot_ref (hd bb)) (transform_pte ab)) (store_pte (hd bb) ab)
 2. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; ?r'83 word cap a b s' aa ba pd ab bb flush x rv'\<rbrakk> \<Longrightarrow> dcorres (?r'67 word cap a b s' aa ba pd ab bb () ()) (?R83 word cap a b s' aa ba pd ab bb flush x) (?R'83 word cap a b s' aa ba pd ab bb flush rv') (return x) (do y <- mapM (swp store_pte InvalidPTE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pte (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od)
 3. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q91 word cap a b s' aa ba pd ab bb () () ()\<rbrace> KHeap_D.set_cap (transform_pt_slot_ref (hd bb)) (transform_pte ab) \<lbrace>?R83 word cap a b s' aa ba pd ab bb flush\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'89 word cap a b s' aa ba pd ab bb () () flush\<rbrace> store_pte (hd bb) ab \<lbrace>?R'83 word cap a b s' aa ba pd ab bb flush\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q74 word cap a b s' aa ba pd ab bb y\<rbrace> return () \<lbrace>\<lambda>c. ?P93 word cap a b s' aa ba pd ab bb y ya c and ?Q91 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 6. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b s' aa ba pd ab bb ya\<rbrace> pte_check_if_mapped (hd bb) \<lbrace>\<lambda>c. ?P'90 word cap a b s' aa ba pd ab bb y ya c and ?Q'89 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 7. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q51 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q74 word cap a b s' aa ba pd ab bb y\<rbrace>
 8. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q'75 word cap a b s' aa ba pd ab bb ya\<rbrace>
 9. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q51 word cap a b s' aa ba pd ab bb) s
 10. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'51 word cap a b s' aa ba pd ab bb) s
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'\<rbrakk> \<Longrightarrow> dcorres (?r'67 word cap a b s' aa ba pd ab bb () ()) (?R83 word cap a b s' aa ba pd ab bb flush x) (?R'83 word cap a b s' aa ba pd ab bb flush rv') (return x) (do y <- mapM (swp store_pte InvalidPTE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pte (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od)
 2. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q91 word cap a b s' aa ba pd ab bb () () ()\<rbrace> KHeap_D.set_cap (transform_pt_slot_ref (hd bb)) (transform_pte ab) \<lbrace>?R83 word cap a b s' aa ba pd ab bb flush\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'89 word cap a b s' aa ba pd ab bb () () flush\<rbrace> store_pte (hd bb) ab \<lbrace>?R'83 word cap a b s' aa ba pd ab bb flush\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q74 word cap a b s' aa ba pd ab bb y\<rbrace> return () \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q91 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b s' aa ba pd ab bb ya\<rbrace> pte_check_if_mapped (hd bb) \<lbrace>\<lambda>c. valid_idle and ?Q'89 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 6. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q51 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q74 word cap a b s' aa ba pd ab bb y\<rbrace>
 7. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q'75 word cap a b s' aa ba pd ab bb ya\<rbrace>
 8. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q51 word cap a b s' aa ba pd ab bb) s
 9. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'51 word cap a b s' aa ba pd ab bb) s
 10. \<And>word cap a b sum s' aa ba pd bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) sum; ip = cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr (a, b)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]); cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs sum c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs sum cap s'; valid_slots sum s'; s' \<turnstile> cap; is_pg_cap cap; \<forall>a. (\<exists>b. sum = Inr (a, b)) \<longrightarrow> pde_ref a = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs sum) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) sum) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; sum = Inr bb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
mapM_x (swp KHeap_D.set_cap (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'\<rbrakk> \<Longrightarrow> dcorres (?r'67 word cap a b s' aa ba pd ab bb () ()) (?R83 word cap a b s' aa ba pd ab bb flush x) (?R'83 word cap a b s' aa ba pd ab bb flush rv') (return x >>= return) (do y <- mapM (swp store_pte InvalidPTE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pte (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od)
 2. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q91 word cap a b s' aa ba pd ab bb () () ()\<rbrace> KHeap_D.set_cap (transform_pt_slot_ref (hd bb)) (transform_pte ab) \<lbrace>?R83 word cap a b s' aa ba pd ab bb flush\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'89 word cap a b s' aa ba pd ab bb () () flush\<rbrace> store_pte (hd bb) ab \<lbrace>?R'83 word cap a b s' aa ba pd ab bb flush\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q74 word cap a b s' aa ba pd ab bb y\<rbrace> return () \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q91 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b s' aa ba pd ab bb ya\<rbrace> pte_check_if_mapped (hd bb) \<lbrace>\<lambda>c. valid_idle and ?Q'89 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 6. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q51 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q74 word cap a b s' aa ba pd ab bb y\<rbrace>
 7. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q'75 word cap a b s' aa ba pd ab bb ya\<rbrace>
 8. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q51 word cap a b s' aa ba pd ab bb) s
 9. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'51 word cap a b s' aa ba pd ab bb) s
 10. \<And>word cap a b sum s' aa ba pd bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) sum; ip = cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr (a, b)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]); cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs sum c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs sum cap s'; valid_slots sum s'; s' \<turnstile> cap; is_pg_cap cap; \<forall>a. (\<exists>b. sum = Inr (a, b)) \<longrightarrow> pde_ref a = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs sum) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) sum) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; sum = Inr bb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
mapM_x (swp KHeap_D.set_cap (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb flush x rv' xa rv'a. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'; dc xa rv'a\<rbrakk> \<Longrightarrow> dcorres (?r'67 word cap a b s' aa ba pd ab bb () ()) (?R113 word cap a b s' aa ba pd ab bb flush x rv' xa) (?R'113 word cap a b s' aa ba pd ab bb flush x rv' rv'a) (return xa) (do y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pte (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od)
 2. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q128 word cap a b s' aa ba pd ab bb flush x\<rbrace> return x \<lbrace>?R113 word cap a b s' aa ba pd ab bb flush x rv'\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'123 word cap a b s' aa ba pd ab bb flush rv'\<rbrace> mapM (swp store_pte InvalidPTE) (tl bb) \<lbrace>?R'113 word cap a b s' aa ba pd ab bb flush x rv'\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q91 word cap a b s' aa ba pd ab bb () () ()\<rbrace> KHeap_D.set_cap (transform_pt_slot_ref (hd bb)) (transform_pte ab) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q128 word cap a b s' aa ba pd ab bb flush c\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'89 word cap a b s' aa ba pd ab bb () () flush\<rbrace> store_pte (hd bb) ab \<lbrace>\<lambda>c. valid_idle and (\<lambda>s. \<exists>f. ako_at (arch_kernel_obj.PageTable f) (?slot126 word cap a b s' aa ba pd ab bb flush c && ~~ mask pt_bits) s \<and> (\<forall>slot\<in>set (tl bb). f (UCAST(32 \<rightarrow> 8) (slot && mask pt_bits >> 2)) = InvalidPTE)) and K (\<forall>sl\<in>set (tl bb). sl && ~~ mask pt_bits = ?slot126 word cap a b s' aa ba pd ab bb flush c && ~~ mask pt_bits) and ?Q'123 word cap a b s' aa ba pd ab bb flush c\<rbrace>
 6. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q74 word cap a b s' aa ba pd ab bb y\<rbrace> return () \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q91 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 7. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b s' aa ba pd ab bb ya\<rbrace> pte_check_if_mapped (hd bb) \<lbrace>\<lambda>c. valid_idle and ?Q'89 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 8. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q51 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q74 word cap a b s' aa ba pd ab bb y\<rbrace>
 9. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q'75 word cap a b s' aa ba pd ab bb ya\<rbrace>
 10. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q51 word cap a b s' aa ba pd ab bb) s
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb flush x rv' xa rv'a. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'; dc xa rv'a\<rbrakk> \<Longrightarrow> dcorres (?r'67 word cap a b s' aa ba pd ab bb () ()) (?R113 word cap a b s' aa ba pd ab bb flush x rv' xa) (?R'113 word cap a b s' aa ba pd ab bb flush x rv' rv'a) (return xa >>= return) (do y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pte (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od)
 2. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q128 word cap a b s' aa ba pd ab bb flush x\<rbrace> return x \<lbrace>?R113 word cap a b s' aa ba pd ab bb flush x rv'\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'123 word cap a b s' aa ba pd ab bb flush rv'\<rbrace> mapM (swp store_pte InvalidPTE) (tl bb) \<lbrace>?R'113 word cap a b s' aa ba pd ab bb flush x rv'\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q91 word cap a b s' aa ba pd ab bb () () ()\<rbrace> KHeap_D.set_cap (transform_pt_slot_ref (hd bb)) (transform_pte ab) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q128 word cap a b s' aa ba pd ab bb flush c\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'89 word cap a b s' aa ba pd ab bb () () flush\<rbrace> store_pte (hd bb) ab \<lbrace>\<lambda>c. valid_idle and (\<lambda>s. \<exists>f. ako_at (arch_kernel_obj.PageTable f) (?slot126 word cap a b s' aa ba pd ab bb flush c && ~~ mask pt_bits) s \<and> (\<forall>slot\<in>set (tl bb). f (UCAST(32 \<rightarrow> 8) (slot && mask pt_bits >> 2)) = InvalidPTE)) and K (\<forall>sl\<in>set (tl bb). sl && ~~ mask pt_bits = ?slot126 word cap a b s' aa ba pd ab bb flush c && ~~ mask pt_bits) and ?Q'123 word cap a b s' aa ba pd ab bb flush c\<rbrace>
 6. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q74 word cap a b s' aa ba pd ab bb y\<rbrace> return () \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q91 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 7. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b s' aa ba pd ab bb ya\<rbrace> pte_check_if_mapped (hd bb) \<lbrace>\<lambda>c. valid_idle and ?Q'89 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 8. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q51 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q74 word cap a b s' aa ba pd ab bb y\<rbrace>
 9. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'51 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q'75 word cap a b s' aa ba pd ab bb ya\<rbrace>
 10. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q51 word cap a b s' aa ba pd ab bb) s
A total of 14 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb flush x rv' xa rv'a. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'; dc xa rv'a\<rbrakk> \<Longrightarrow> dcorres (?r'134 word cap a b s' aa ba pd ab bb flush x rv' xa rv'a) (?P151 word cap a b s' aa ba pd ab bb flush x rv' xa) (?P'147 word cap a b s' aa ba pd ab bb flush x rv' rv'a) (return xa) (do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pte (last bb)) (addrFromPPtr (hd bb))))
 2. \<And>word cap a b s' aa ba pd ab bb flush x rv' xa rv'a. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'; dc xa rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q149 word cap a b s' aa ba pd ab bb flush x rv' xa\<rbrace> return xa \<lbrace>\<lambda>x _. True\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb flush x rv' xa rv'a. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'; dc xa rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'145 word cap a b s' aa ba pd ab bb flush x rv' rv'a\<rbrace> do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pte (last bb)) (addrFromPPtr (hd bb))) \<lbrace>\<lambda>rv' _. True\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q128 word cap a b s' aa ba pd ab bb flush x\<rbrace> return x \<lbrace>\<lambda>c. ?P151 word cap a b s' aa ba pd ab bb flush x rv' c and ?Q149 word cap a b s' aa ba pd ab bb flush x rv' c\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'123 word cap a b s' aa ba pd ab bb flush rv'\<rbrace> mapM (swp store_pte InvalidPTE) (tl bb) \<lbrace>\<lambda>c. ?P'147 word cap a b s' aa ba pd ab bb flush x rv' c and ?Q'145 word cap a b s' aa ba pd ab bb flush x rv' c\<rbrace>
 6. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q91 word cap a b s' aa ba pd ab bb () () ()\<rbrace> KHeap_D.set_cap (transform_pt_slot_ref (hd bb)) (transform_pte ab) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q128 word cap a b s' aa ba pd ab bb flush c\<rbrace>
 7. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'89 word cap a b s' aa ba pd ab bb () () flush\<rbrace> store_pte (hd bb) ab \<lbrace>\<lambda>c. valid_idle and (\<lambda>s. \<exists>f. ako_at (arch_kernel_obj.PageTable f) (?slot126 word cap a b s' aa ba pd ab bb flush c && ~~ mask pt_bits) s \<and> (\<forall>slot\<in>set (tl bb). f (UCAST(32 \<rightarrow> 8) (slot && mask pt_bits >> 2)) = InvalidPTE)) and K (\<forall>sl\<in>set (tl bb). sl && ~~ mask pt_bits = ?slot126 word cap a b s' aa ba pd ab bb flush c && ~~ mask pt_bits) and ?Q'123 word cap a b s' aa ba pd ab bb flush c\<rbrace>
 8. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q74 word cap a b s' aa ba pd ab bb y\<rbrace> return () \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q91 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 9. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b s' aa ba pd ab bb ya\<rbrace> pte_check_if_mapped (hd bb) \<lbrace>\<lambda>c. valid_idle and ?Q'89 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 10. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q51 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q74 word cap a b s' aa ba pd ab bb y\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb flush x rv' xa rv'a cs. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'; dc xa rv'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True \<and> transform s = cs\<rbrace> do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pte (last bb)) (addrFromPPtr (hd bb))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 2. \<And>word cap a b s' aa ba pd ab bb flush x rv' xa rv'a. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'; dc xa rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q149 word cap a b s' aa ba pd ab bb flush x rv' xa\<rbrace> return xa \<lbrace>\<lambda>x _. True\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb flush x rv' xa rv'a. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'; dc xa rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'145 word cap a b s' aa ba pd ab bb flush x rv' rv'a\<rbrace> do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pte (last bb)) (addrFromPPtr (hd bb))) \<lbrace>\<lambda>rv' _. True\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q128 word cap a b s' aa ba pd ab bb flush x\<rbrace> return x \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q149 word cap a b s' aa ba pd ab bb flush x rv' c\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'123 word cap a b s' aa ba pd ab bb flush rv'\<rbrace> mapM (swp store_pte InvalidPTE) (tl bb) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q'145 word cap a b s' aa ba pd ab bb flush x rv' c\<rbrace>
 6. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q91 word cap a b s' aa ba pd ab bb () () ()\<rbrace> KHeap_D.set_cap (transform_pt_slot_ref (hd bb)) (transform_pte ab) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q128 word cap a b s' aa ba pd ab bb flush c\<rbrace>
 7. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'89 word cap a b s' aa ba pd ab bb () () flush\<rbrace> store_pte (hd bb) ab \<lbrace>\<lambda>c. valid_idle and (\<lambda>s. \<exists>f. ako_at (arch_kernel_obj.PageTable f) (?slot126 word cap a b s' aa ba pd ab bb flush c && ~~ mask pt_bits) s \<and> (\<forall>slot\<in>set (tl bb). f (UCAST(32 \<rightarrow> 8) (slot && mask pt_bits >> 2)) = InvalidPTE)) and K (\<forall>sl\<in>set (tl bb). sl && ~~ mask pt_bits = ?slot126 word cap a b s' aa ba pd ab bb flush c && ~~ mask pt_bits) and ?Q'123 word cap a b s' aa ba pd ab bb flush c\<rbrace>
 8. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q74 word cap a b s' aa ba pd ab bb y\<rbrace> return () \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q91 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 9. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'75 word cap a b s' aa ba pd ab bb ya\<rbrace> pte_check_if_mapped (hd bb) \<lbrace>\<lambda>c. valid_idle and ?Q'89 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 10. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inl (ab, bb)) cap s'; valid_slots (Inl (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_entries_safe (Inl (ab, bb)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q51 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q74 word cap a b s' aa ba pd ab bb y\<rbrace>
A total of 16 subgoals... proof (prove)
goal (4 subgoals):
 1. \<And>word cap a b aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (a, b)) [transform_pt_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s \<or> cte_wp_at (\<lambda>c. same_refs (Inl (ab, bb)) c s) (a, b) s; cte_wp_at is_pg_cap (a, b) s; same_refs (Inl (ab, bb)) cap s; valid_slots (Inl (ab, bb)) s; s \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inl (ab, bb))) (aa, ba) s; vspace_at_asid word pd s; invs s; page_inv_entries_safe (Inl (ab, bb)) s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s\<rbrakk> \<Longrightarrow> valid_idle s \<and> a \<noteq> idle_thread s \<and> valid_idle s
 2. \<And>word cap a b sum s' aa ba pd bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) sum; ip = cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr (a, b)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]); cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs sum c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs sum cap s'; valid_slots sum s'; s' \<turnstile> cap; is_pg_cap cap; \<forall>a. (\<exists>b. sum = Inr (a, b)) \<longrightarrow> pde_ref a = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs sum) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) sum) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; sum = Inr bb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
mapM_x (swp KHeap_D.set_cap (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 3. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (4 subgoals):
 1. \<And>word cap b aa ba pd ab bb s capa capc. \<lbrakk>ip' = page_invocation.PageMap word cap (idle_thread s, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (idle_thread s, b)) [transform_pt_slot_ref (hd bb)]; vs_cap_ref capa = None \<or> same_refs (Inl (ab, bb)) capa s; same_refs (Inl (ab, bb)) cap s; valid_slots (Inl (ab, bb)) s; s \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd s; page_inv_entries_safe (Inl (ab, bb)) s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; valid_pspace s; is_arch_update cap capa; caps_of_state s (idle_thread s, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; parent_for_refs (Inl (ab, bb)) capc; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s\<rbrakk> \<Longrightarrow> False
 2. \<And>word cap a b sum s' aa ba pd bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) sum; ip = cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr (a, b)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]); cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs sum c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs sum cap s'; valid_slots sum s'; s' \<turnstile> cap; is_pg_cap cap; \<forall>a. (\<exists>b. sum = Inr (a, b)) \<longrightarrow> pde_ref a = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs sum) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) sum) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; sum = Inr bb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
mapM_x (swp KHeap_D.set_cap (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 3. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (4 subgoals):
 1. \<And>word cap b aa ba pd ab bb s capa capc. \<lbrakk>ip' = page_invocation.PageMap word cap (idle_thread s, b) (Inl (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pte ab) (transform_cslot_ptr (idle_thread s, b)) [transform_pt_slot_ref (hd bb)]; vs_cap_ref cap.NullCap = None \<or> same_refs (Inl (ab, bb)) cap.NullCap s; same_refs (Inl (ab, bb)) cap s; valid_slots (Inl (ab, bb)) s; s \<turnstile> cap; is_pg_cap cap; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd s; page_inv_entries_safe (Inl (ab, bb)) s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; valid_pspace s; is_arch_update cap cap.NullCap; caps_of_state s (idle_thread s, b) = Some cap.NullCap; is_pg_cap cap.NullCap; caps_of_state s (aa, ba) = Some capc; parent_for_refs (Inl (ab, bb)) capc; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; capa = cap.NullCap\<rbrakk> \<Longrightarrow> False
 2. \<And>word cap a b sum s' aa ba pd bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) sum; ip = cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr (a, b)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]); cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs sum c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs sum cap s'; valid_slots sum s'; s' \<turnstile> cap; is_pg_cap cap; \<forall>a. (\<exists>b. sum = Inr (a, b)) \<longrightarrow> pde_ref a = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs sum) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) sum) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; sum = Inr bb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
mapM_x (swp KHeap_D.set_cap (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 3. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (3 subgoals):
 1. \<And>word cap a b sum s' aa ba pd bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) sum; ip = cdl_page_invocation.PageMap (transform_cap cap) (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) (transform_cslot_ptr (a, b)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]); cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs sum c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs sum cap s'; valid_slots sum s'; s' \<turnstile> cap; is_pg_cap cap; \<forall>a. (\<exists>b. sum = Inr (a, b)) \<longrightarrow> pde_ref a = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs sum) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) sum) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; sum = Inr bb\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
mapM_x (swp KHeap_D.set_cap (case sum of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x)) (case sum of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- case sum of Inl (pte, slots) \<Rightarrow> do flush <- pte_check_if_mapped (hd slots);
store_pte (hd slots) pte;
mapM (swp store_pte InvalidPTE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pte (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od | Inr (pde, slots) \<Rightarrow> do flush <- pde_check_if_mapped (hd slots);
store_pde (hd slots) pde;
mapM (swp store_pde InvalidPDE) (tl slots);
do_machine_op $ cleanCacheRange_PoU (hd slots) (last_byte_pde (last slots)) (addrFromPPtr (hd slots));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 2. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (3 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
KHeap_D.set_cap (transform_pd_slot_ref (hd bb)) (transform_pde ab)
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- do flush <- pde_check_if_mapped (hd bb);
y <- store_pde (hd bb) ab;
y <- mapM (swp store_pde InvalidPDE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pde (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 2. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (5 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> dcorres dc (?Q370 word cap a b s' aa ba pd ab bb) (?Q'370 word cap a b s' aa ba pd ab bb) (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap);
KHeap_D.set_cap (transform_pd_slot_ref (hd bb)) (transform_pde ab)
od) (do y <- CSpaceAcc_A.set_cap cap (a, b);
y <- do flush <- pde_check_if_mapped (hd bb);
y <- store_pde (hd bb) ab;
y <- mapM (swp store_pde InvalidPDE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pde (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 2. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ?Q370 word cap a b s' aa ba pd ab bb s
 3. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> ?Q'370 word cap a b s' aa ba pd ab bb s
 4. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 5. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (8 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> dcorres (?r'374 word cap a b s' aa ba pd ab bb) (?P374 word cap a b s' aa ba pd ab bb) (?P'374 word cap a b s' aa ba pd ab bb) (KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap)) (CSpaceAcc_A.set_cap cap (a, b))
 2. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ?r'374 word cap a b s' aa ba pd ab bb y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R374 word cap a b s' aa ba pd ab bb y) (?R'374 word cap a b s' aa ba pd ab bb ya) (KHeap_D.set_cap (transform_pd_slot_ref (hd bb)) (transform_pde ab)) (do y <- do flush <- pde_check_if_mapped (hd bb);
y <- store_pde (hd bb) ab;
y <- mapM (swp store_pde InvalidPDE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pde (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 3. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q374 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>?R374 word cap a b s' aa ba pd ab bb\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'374 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>?R'374 word cap a b s' aa ba pd ab bb\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> (?P374 word cap a b s' aa ba pd ab bb and ?Q374 word cap a b s' aa ba pd ab bb) s
 6. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> (?P'374 word cap a b s' aa ba pd ab bb and ?Q'374 word cap a b s' aa ba pd ab bb) s
 7. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (7 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R374 word cap a b s' aa ba pd ab bb y) (?R'374 word cap a b s' aa ba pd ab bb ya) (KHeap_D.set_cap (transform_pd_slot_ref (hd bb)) (transform_pde ab)) (do y <- do flush <- pde_check_if_mapped (hd bb);
y <- store_pde (hd bb) ab;
y <- mapM (swp store_pde InvalidPDE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pde (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od;
return []
od)
 2. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q374 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>?R374 word cap a b s' aa ba pd ab bb\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'374 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>?R'374 word cap a b s' aa ba pd ab bb\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q374 word cap a b s' aa ba pd ab bb) s
 5. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'374 word cap a b s' aa ba pd ab bb) s
 6. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (7 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> dcorres (?r'390 word cap a b s' aa ba pd ab bb y ya) (?R374 word cap a b s' aa ba pd ab bb y) (?R'374 word cap a b s' aa ba pd ab bb ya) (KHeap_D.set_cap (transform_pd_slot_ref (hd bb)) (transform_pde ab)) (do flush <- pde_check_if_mapped (hd bb);
y <- store_pde (hd bb) ab;
y <- mapM (swp store_pde InvalidPDE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pde (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od)
 2. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q374 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>?R374 word cap a b s' aa ba pd ab bb\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'374 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>?R'374 word cap a b s' aa ba pd ab bb\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q374 word cap a b s' aa ba pd ab bb) s
 5. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'374 word cap a b s' aa ba pd ab bb) s
 6. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (7 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> dcorres (?r'390 word cap a b s' aa ba pd ab bb y ya) (?R374 word cap a b s' aa ba pd ab bb y) (?R'374 word cap a b s' aa ba pd ab bb ya) (do return ();
KHeap_D.set_cap (transform_pd_slot_ref (hd bb)) (transform_pde ab)
od) (do flush <- pde_check_if_mapped (hd bb);
y <- store_pde (hd bb) ab;
y <- mapM (swp store_pde InvalidPDE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pde (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od)
 2. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q374 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>?R374 word cap a b s' aa ba pd ab bb\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'374 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>?R'374 word cap a b s' aa ba pd ab bb\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q374 word cap a b s' aa ba pd ab bb) s
 5. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'374 word cap a b s' aa ba pd ab bb) s
 6. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb y ya rv flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya; dc rv flush\<rbrakk> \<Longrightarrow> dcorres (?r'390 word cap a b s' aa ba pd ab bb y ya) (?R395 word cap a b s' aa ba pd ab bb y ya rv) (?R'395 word cap a b s' aa ba pd ab bb y ya flush) (K_bind (KHeap_D.set_cap (transform_pd_slot_ref (hd bb)) (transform_pde ab)) rv) (do y <- store_pde (hd bb) ab;
y <- mapM (swp store_pde InvalidPDE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pde (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od)
 2. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q397 word cap a b s' aa ba pd ab bb y\<rbrace> return () \<lbrace>?R395 word cap a b s' aa ba pd ab bb y ya\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'398 word cap a b s' aa ba pd ab bb ya\<rbrace> pde_check_if_mapped (hd bb) \<lbrace>?R'395 word cap a b s' aa ba pd ab bb y ya\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q374 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q397 word cap a b s' aa ba pd ab bb y\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'374 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q'398 word cap a b s' aa ba pd ab bb ya\<rbrace>
 6. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q374 word cap a b s' aa ba pd ab bb) s
 7. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'374 word cap a b s' aa ba pd ab bb) s
 8. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> dcorres (?r'390 word cap a b s' aa ba pd ab bb () ()) (?R395 word cap a b s' aa ba pd ab bb () () ()) (?R'395 word cap a b s' aa ba pd ab bb () () flush) (KHeap_D.set_cap (transform_pd_slot_ref (hd bb)) (transform_pde ab)) (do y <- store_pde (hd bb) ab;
y <- mapM (swp store_pde InvalidPDE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pde (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od)
 2. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q397 word cap a b s' aa ba pd ab bb y\<rbrace> return () \<lbrace>?R395 word cap a b s' aa ba pd ab bb y ya\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'398 word cap a b s' aa ba pd ab bb ya\<rbrace> pde_check_if_mapped (hd bb) \<lbrace>?R'395 word cap a b s' aa ba pd ab bb y ya\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q374 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q397 word cap a b s' aa ba pd ab bb y\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'374 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q'398 word cap a b s' aa ba pd ab bb ya\<rbrace>
 6. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q374 word cap a b s' aa ba pd ab bb) s
 7. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'374 word cap a b s' aa ba pd ab bb) s
 8. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (9 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> dcorres (?r'390 word cap a b s' aa ba pd ab bb () ()) (?R395 word cap a b s' aa ba pd ab bb () () ()) (?R'395 word cap a b s' aa ba pd ab bb () () flush) (KHeap_D.set_cap (transform_pd_slot_ref (hd bb)) (transform_pde ab) >>= return) (do y <- store_pde (hd bb) ab;
y <- mapM (swp store_pde InvalidPDE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pde (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od)
 2. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q397 word cap a b s' aa ba pd ab bb y\<rbrace> return () \<lbrace>?R395 word cap a b s' aa ba pd ab bb y ya\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'398 word cap a b s' aa ba pd ab bb ya\<rbrace> pde_check_if_mapped (hd bb) \<lbrace>?R'395 word cap a b s' aa ba pd ab bb y ya\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q374 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q397 word cap a b s' aa ba pd ab bb y\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'374 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q'398 word cap a b s' aa ba pd ab bb ya\<rbrace>
 6. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q374 word cap a b s' aa ba pd ab bb) s
 7. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'374 word cap a b s' aa ba pd ab bb) s
 8. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (12 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> dcorres (?r'406 word cap a b s' aa ba pd ab bb flush) (?P416 word cap a b s' aa ba pd ab bb () () ()) (?P'413 word cap a b s' aa ba pd ab bb () () flush) (KHeap_D.set_cap (transform_pd_slot_ref (hd bb)) (transform_pde ab)) (store_pde (hd bb) ab)
 2. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; ?r'406 word cap a b s' aa ba pd ab bb flush x rv'\<rbrakk> \<Longrightarrow> dcorres (?r'390 word cap a b s' aa ba pd ab bb () ()) (?R406 word cap a b s' aa ba pd ab bb flush x) (?R'406 word cap a b s' aa ba pd ab bb flush rv') (return x) (do y <- mapM (swp store_pde InvalidPDE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pde (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od)
 3. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q414 word cap a b s' aa ba pd ab bb () () ()\<rbrace> KHeap_D.set_cap (transform_pd_slot_ref (hd bb)) (transform_pde ab) \<lbrace>?R406 word cap a b s' aa ba pd ab bb flush\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'412 word cap a b s' aa ba pd ab bb () () flush\<rbrace> store_pde (hd bb) ab \<lbrace>?R'406 word cap a b s' aa ba pd ab bb flush\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q397 word cap a b s' aa ba pd ab bb y\<rbrace> return () \<lbrace>\<lambda>c. ?P416 word cap a b s' aa ba pd ab bb y ya c and ?Q414 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 6. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'398 word cap a b s' aa ba pd ab bb ya\<rbrace> pde_check_if_mapped (hd bb) \<lbrace>\<lambda>c. ?P'413 word cap a b s' aa ba pd ab bb y ya c and ?Q'412 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 7. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q374 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q397 word cap a b s' aa ba pd ab bb y\<rbrace>
 8. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'374 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q'398 word cap a b s' aa ba pd ab bb ya\<rbrace>
 9. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q374 word cap a b s' aa ba pd ab bb) s
 10. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'374 word cap a b s' aa ba pd ab bb) s
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'\<rbrakk> \<Longrightarrow> dcorres (?r'390 word cap a b s' aa ba pd ab bb () ()) (?R406 word cap a b s' aa ba pd ab bb flush x) (?R'406 word cap a b s' aa ba pd ab bb flush rv') (return x) (do y <- mapM (swp store_pde InvalidPDE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pde (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od)
 2. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q414 word cap a b s' aa ba pd ab bb () () ()\<rbrace> KHeap_D.set_cap (transform_pd_slot_ref (hd bb)) (transform_pde ab) \<lbrace>?R406 word cap a b s' aa ba pd ab bb flush\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'412 word cap a b s' aa ba pd ab bb () () flush\<rbrace> store_pde (hd bb) ab \<lbrace>?R'406 word cap a b s' aa ba pd ab bb flush\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q397 word cap a b s' aa ba pd ab bb y\<rbrace> return () \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q414 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'398 word cap a b s' aa ba pd ab bb ya\<rbrace> pde_check_if_mapped (hd bb) \<lbrace>\<lambda>c. valid_idle and ?Q'412 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 6. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q374 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q397 word cap a b s' aa ba pd ab bb y\<rbrace>
 7. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'374 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q'398 word cap a b s' aa ba pd ab bb ya\<rbrace>
 8. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q374 word cap a b s' aa ba pd ab bb) s
 9. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'374 word cap a b s' aa ba pd ab bb) s
 10. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'\<rbrakk> \<Longrightarrow> dcorres (?r'390 word cap a b s' aa ba pd ab bb () ()) (?R406 word cap a b s' aa ba pd ab bb flush x) (?R'406 word cap a b s' aa ba pd ab bb flush rv') (return x >>= return) (do y <- mapM (swp store_pde InvalidPDE) (tl bb);
y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pde (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od)
 2. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q414 word cap a b s' aa ba pd ab bb () () ()\<rbrace> KHeap_D.set_cap (transform_pd_slot_ref (hd bb)) (transform_pde ab) \<lbrace>?R406 word cap a b s' aa ba pd ab bb flush\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'412 word cap a b s' aa ba pd ab bb () () flush\<rbrace> store_pde (hd bb) ab \<lbrace>?R'406 word cap a b s' aa ba pd ab bb flush\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q397 word cap a b s' aa ba pd ab bb y\<rbrace> return () \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q414 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'398 word cap a b s' aa ba pd ab bb ya\<rbrace> pde_check_if_mapped (hd bb) \<lbrace>\<lambda>c. valid_idle and ?Q'412 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 6. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q374 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q397 word cap a b s' aa ba pd ab bb y\<rbrace>
 7. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'374 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q'398 word cap a b s' aa ba pd ab bb ya\<rbrace>
 8. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q374 word cap a b s' aa ba pd ab bb) s
 9. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'374 word cap a b s' aa ba pd ab bb) s
 10. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb flush x rv' xa rv'a. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'; dc xa rv'a\<rbrakk> \<Longrightarrow> dcorres (?r'390 word cap a b s' aa ba pd ab bb () ()) (?R439 word cap a b s' aa ba pd ab bb flush x rv' xa) (?R'439 word cap a b s' aa ba pd ab bb flush x rv' rv'a) (return xa) (do y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pde (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od)
 2. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q454 word cap a b s' aa ba pd ab bb flush x\<rbrace> return x \<lbrace>?R439 word cap a b s' aa ba pd ab bb flush x rv'\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'449 word cap a b s' aa ba pd ab bb flush rv'\<rbrace> mapM (swp store_pde InvalidPDE) (tl bb) \<lbrace>?R'439 word cap a b s' aa ba pd ab bb flush x rv'\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q414 word cap a b s' aa ba pd ab bb () () ()\<rbrace> KHeap_D.set_cap (transform_pd_slot_ref (hd bb)) (transform_pde ab) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q454 word cap a b s' aa ba pd ab bb flush c\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'412 word cap a b s' aa ba pd ab bb () () flush\<rbrace> store_pde (hd bb) ab \<lbrace>\<lambda>c. valid_idle and (\<lambda>s. \<exists>f. ako_at (arch_kernel_obj.PageDirectory f) (?slot452 word cap a b s' aa ba pd ab bb flush c && ~~ mask pd_bits) s \<and> (\<forall>slot\<in>set (tl bb). f (UCAST(32 \<rightarrow> 12) (slot && mask pd_bits >> 2)) = InvalidPDE)) and K (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits = ?slot452 word cap a b s' aa ba pd ab bb flush c && ~~ mask pd_bits) and ?Q'449 word cap a b s' aa ba pd ab bb flush c\<rbrace>
 6. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q397 word cap a b s' aa ba pd ab bb y\<rbrace> return () \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q414 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 7. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'398 word cap a b s' aa ba pd ab bb ya\<rbrace> pde_check_if_mapped (hd bb) \<lbrace>\<lambda>c. valid_idle and ?Q'412 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 8. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q374 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q397 word cap a b s' aa ba pd ab bb y\<rbrace>
 9. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'374 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q'398 word cap a b s' aa ba pd ab bb ya\<rbrace>
 10. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q374 word cap a b s' aa ba pd ab bb) s
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb flush x rv' xa rv'a. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'; dc xa rv'a\<rbrakk> \<Longrightarrow> dcorres (?r'390 word cap a b s' aa ba pd ab bb () ()) (?R439 word cap a b s' aa ba pd ab bb flush x rv' xa) (?R'439 word cap a b s' aa ba pd ab bb flush x rv' rv'a) (return xa >>= return) (do y <- do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pde (last bb)) (addrFromPPtr (hd bb)));
if flush then invalidate_tlb_by_asid word else return ()
od)
 2. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q454 word cap a b s' aa ba pd ab bb flush x\<rbrace> return x \<lbrace>?R439 word cap a b s' aa ba pd ab bb flush x rv'\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'449 word cap a b s' aa ba pd ab bb flush rv'\<rbrace> mapM (swp store_pde InvalidPDE) (tl bb) \<lbrace>?R'439 word cap a b s' aa ba pd ab bb flush x rv'\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q414 word cap a b s' aa ba pd ab bb () () ()\<rbrace> KHeap_D.set_cap (transform_pd_slot_ref (hd bb)) (transform_pde ab) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q454 word cap a b s' aa ba pd ab bb flush c\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'412 word cap a b s' aa ba pd ab bb () () flush\<rbrace> store_pde (hd bb) ab \<lbrace>\<lambda>c. valid_idle and (\<lambda>s. \<exists>f. ako_at (arch_kernel_obj.PageDirectory f) (?slot452 word cap a b s' aa ba pd ab bb flush c && ~~ mask pd_bits) s \<and> (\<forall>slot\<in>set (tl bb). f (UCAST(32 \<rightarrow> 12) (slot && mask pd_bits >> 2)) = InvalidPDE)) and K (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits = ?slot452 word cap a b s' aa ba pd ab bb flush c && ~~ mask pd_bits) and ?Q'449 word cap a b s' aa ba pd ab bb flush c\<rbrace>
 6. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q397 word cap a b s' aa ba pd ab bb y\<rbrace> return () \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q414 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 7. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'398 word cap a b s' aa ba pd ab bb ya\<rbrace> pde_check_if_mapped (hd bb) \<lbrace>\<lambda>c. valid_idle and ?Q'412 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 8. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q374 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q397 word cap a b s' aa ba pd ab bb y\<rbrace>
 9. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'374 word cap a b s' aa ba pd ab bb\<rbrace> CSpaceAcc_A.set_cap cap (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q'398 word cap a b s' aa ba pd ab bb ya\<rbrace>
 10. \<And>word cap a b s' aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q374 word cap a b s' aa ba pd ab bb) s
A total of 13 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb flush x rv' xa rv'a. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'; dc xa rv'a\<rbrakk> \<Longrightarrow> dcorres (?r'460 word cap a b s' aa ba pd ab bb flush x rv' xa rv'a) (?P477 word cap a b s' aa ba pd ab bb flush x rv' xa) (?P'473 word cap a b s' aa ba pd ab bb flush x rv' rv'a) (return xa) (do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pde (last bb)) (addrFromPPtr (hd bb))))
 2. \<And>word cap a b s' aa ba pd ab bb flush x rv' xa rv'a. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'; dc xa rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q475 word cap a b s' aa ba pd ab bb flush x rv' xa\<rbrace> return xa \<lbrace>\<lambda>x _. True\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb flush x rv' xa rv'a. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'; dc xa rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'471 word cap a b s' aa ba pd ab bb flush x rv' rv'a\<rbrace> do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pde (last bb)) (addrFromPPtr (hd bb))) \<lbrace>\<lambda>rv' _. True\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q454 word cap a b s' aa ba pd ab bb flush x\<rbrace> return x \<lbrace>\<lambda>c. ?P477 word cap a b s' aa ba pd ab bb flush x rv' c and ?Q475 word cap a b s' aa ba pd ab bb flush x rv' c\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'449 word cap a b s' aa ba pd ab bb flush rv'\<rbrace> mapM (swp store_pde InvalidPDE) (tl bb) \<lbrace>\<lambda>c. ?P'473 word cap a b s' aa ba pd ab bb flush x rv' c and ?Q'471 word cap a b s' aa ba pd ab bb flush x rv' c\<rbrace>
 6. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q414 word cap a b s' aa ba pd ab bb () () ()\<rbrace> KHeap_D.set_cap (transform_pd_slot_ref (hd bb)) (transform_pde ab) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q454 word cap a b s' aa ba pd ab bb flush c\<rbrace>
 7. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'412 word cap a b s' aa ba pd ab bb () () flush\<rbrace> store_pde (hd bb) ab \<lbrace>\<lambda>c. valid_idle and (\<lambda>s. \<exists>f. ako_at (arch_kernel_obj.PageDirectory f) (?slot452 word cap a b s' aa ba pd ab bb flush c && ~~ mask pd_bits) s \<and> (\<forall>slot\<in>set (tl bb). f (UCAST(32 \<rightarrow> 12) (slot && mask pd_bits >> 2)) = InvalidPDE)) and K (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits = ?slot452 word cap a b s' aa ba pd ab bb flush c && ~~ mask pd_bits) and ?Q'449 word cap a b s' aa ba pd ab bb flush c\<rbrace>
 8. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q397 word cap a b s' aa ba pd ab bb y\<rbrace> return () \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q414 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 9. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'398 word cap a b s' aa ba pd ab bb ya\<rbrace> pde_check_if_mapped (hd bb) \<lbrace>\<lambda>c. valid_idle and ?Q'412 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 10. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q374 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q397 word cap a b s' aa ba pd ab bb y\<rbrace>
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>word cap a b s' aa ba pd ab bb flush x rv' xa rv'a cs. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'; dc xa rv'a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True \<and> transform s = cs\<rbrace> do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pde (last bb)) (addrFromPPtr (hd bb))) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 2. \<And>word cap a b s' aa ba pd ab bb flush x rv' xa rv'a. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'; dc xa rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q475 word cap a b s' aa ba pd ab bb flush x rv' xa\<rbrace> return xa \<lbrace>\<lambda>x _. True\<rbrace>
 3. \<And>word cap a b s' aa ba pd ab bb flush x rv' xa rv'a. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'; dc xa rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?Q'471 word cap a b s' aa ba pd ab bb flush x rv' rv'a\<rbrace> do_machine_op (cleanCacheRange_PoU (hd bb) (last_byte_pde (last bb)) (addrFromPPtr (hd bb))) \<lbrace>\<lambda>rv' _. True\<rbrace>
 4. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q454 word cap a b s' aa ba pd ab bb flush x\<rbrace> return x \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q475 word cap a b s' aa ba pd ab bb flush x rv' c\<rbrace>
 5. \<And>word cap a b s' aa ba pd ab bb flush x rv'. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'; dc x rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'449 word cap a b s' aa ba pd ab bb flush rv'\<rbrace> mapM (swp store_pde InvalidPDE) (tl bb) \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q'471 word cap a b s' aa ba pd ab bb flush x rv' c\<rbrace>
 6. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q414 word cap a b s' aa ba pd ab bb () () ()\<rbrace> KHeap_D.set_cap (transform_pd_slot_ref (hd bb)) (transform_pde ab) \<lbrace>\<lambda>c. (\<lambda>_. True) and ?Q454 word cap a b s' aa ba pd ab bb flush c\<rbrace>
 7. \<And>word cap a b s' aa ba pd ab bb flush. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; Ball (ran (kheap s')) obj_valid_pdpt; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'412 word cap a b s' aa ba pd ab bb () () flush\<rbrace> store_pde (hd bb) ab \<lbrace>\<lambda>c. valid_idle and (\<lambda>s. \<exists>f. ako_at (arch_kernel_obj.PageDirectory f) (?slot452 word cap a b s' aa ba pd ab bb flush c && ~~ mask pd_bits) s \<and> (\<forall>slot\<in>set (tl bb). f (UCAST(32 \<rightarrow> 12) (slot && mask pd_bits >> 2)) = InvalidPDE)) and K (\<forall>sl\<in>set (tl bb). sl && ~~ mask pd_bits = ?slot452 word cap a b s' aa ba pd ab bb flush c && ~~ mask pd_bits) and ?Q'449 word cap a b s' aa ba pd ab bb flush c\<rbrace>
 8. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q397 word cap a b s' aa ba pd ab bb y\<rbrace> return () \<lbrace>\<lambda>c. (\<lambda>a. True) and ?Q414 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 9. \<And>word cap a b s' aa ba pd ab bb y ya. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'398 word cap a b s' aa ba pd ab bb ya\<rbrace> pde_check_if_mapped (hd bb) \<lbrace>\<lambda>c. valid_idle and ?Q'412 word cap a b s' aa ba pd ab bb y ya c\<rbrace>
 10. \<And>word cap a b s' aa ba pd ab bb. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s'; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s' \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s') (a, b) s'; cte_wp_at is_pg_cap (a, b) s'; same_refs (Inr (ab, bb)) cap s'; valid_slots (Inr (ab, bb)) s'; s' \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s'; vspace_at_asid word pd s'; invs s'; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q374 word cap a b s' aa ba pd ab bb\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap cap) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q397 word cap a b s' aa ba pd ab bb y\<rbrace>
A total of 15 subgoals... proof (prove)
goal (3 subgoals):
 1. \<And>word cap a b aa ba pd ab bb s. \<lbrakk>ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s) (a, b) s; cte_wp_at is_pg_cap (a, b) s; same_refs (Inr (ab, bb)) cap s; valid_slots (Inr (ab, bb)) s; s \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s; vspace_at_asid word pd s; invs s; page_inv_duplicates_valid (page_invocation.PageMap word cap (a, b) (Inr (ab, bb))) s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s\<rbrakk> \<Longrightarrow> valid_idle s \<and> a \<noteq> idle_thread s \<and> valid_idle s \<and> page_inv_entries_safe (Inr (ab, bb)) s
 2. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (4 subgoals):
 1. \<And>word cap a b aa ba pd ab bb s sl. \<lbrakk>\<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, [sl])); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref sl]; cte_wp_at (is_arch_update cap) (a, b) s; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, [sl])) c s) (a, b) s; cte_wp_at is_pg_cap (a, b) s; same_refs (Inr (ab, [sl])) cap s; s \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, [sl]))) (aa, ba) s; vspace_at_asid word pd s; invs s; (\<exists>ref. (ref \<rhd> (sl && ~~ mask pd_bits)) s) \<and> pde_at sl s \<and> UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots; wellformed_pde ab; valid_pde ab s; bb = [sl]; obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (arch_kernel_obj.PageDirectory pd) \<and> pde_range_sz (pd (UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) && ~~ mask 4)) = 0) (sl && ~~ mask pd_bits) s \<and> pde_range_sz ab = 0\<rbrakk> \<Longrightarrow> valid_idle s \<and> a \<noteq> idle_thread s \<and> valid_idle s
 2. \<And>word cap a b aa ba pd ab bb s. \<lbrakk>\<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s) (a, b) s; cte_wp_at is_pg_cap (a, b) s; same_refs (Inr (ab, bb)) cap s; s \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s; vspace_at_asid word pd s; invs s; \<forall>sl. bb \<noteq> [sl]; bb \<noteq> []; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; wellformed_pde ab; valid_pde ab s; \<exists>p. is_aligned p 6 \<and> bb = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C] \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (arch_kernel_obj.PageDirectory pd) \<and> (\<forall>x\<in>set (tl bb). pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (hd bb && ~~ mask pd_bits) s\<rbrakk> \<Longrightarrow> valid_idle s \<and> a \<noteq> idle_thread s \<and> valid_idle s
 3. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (4 subgoals):
 1. \<And>word cap b aa ba pd ab s sl capa capc ref. \<lbrakk>\<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; ip' = page_invocation.PageMap word cap (idle_thread s, b) (Inr (ab, [sl])); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (idle_thread s, b)) [transform_pd_slot_ref sl]; vs_cap_ref capa = None \<or> same_refs (Inr (ab, [sl])) capa s; same_refs (Inr (ab, [sl])) cap s; s \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd s; wellformed_pde ab; valid_pde ab s; valid_pspace s; (ref \<rhd> (sl && ~~ mask pd_bits)) s; obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (arch_kernel_obj.PageDirectory pd) \<and> pde_range_sz (pd (UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) && ~~ mask 4)) = 0) (sl && ~~ mask pd_bits) s; pde_range_sz ab = 0; is_arch_update cap capa; caps_of_state s (idle_thread s, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; parent_for_refs (Inr (ab, [sl])) capc; valid_mdb s; pde_at sl s; UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s\<rbrakk> \<Longrightarrow> False
 2. \<And>word cap a b aa ba pd ab bb s. \<lbrakk>\<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s) (a, b) s; cte_wp_at is_pg_cap (a, b) s; same_refs (Inr (ab, bb)) cap s; s \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s; vspace_at_asid word pd s; invs s; \<forall>sl. bb \<noteq> [sl]; bb \<noteq> []; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; wellformed_pde ab; valid_pde ab s; \<exists>p. is_aligned p 6 \<and> bb = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C] \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (arch_kernel_obj.PageDirectory pd) \<and> (\<forall>x\<in>set (tl bb). pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (hd bb && ~~ mask pd_bits) s\<rbrakk> \<Longrightarrow> valid_idle s \<and> a \<noteq> idle_thread s \<and> valid_idle s
 3. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (4 subgoals):
 1. \<And>word cap b aa ba pd ab s sl capa capc ref. \<lbrakk>\<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; ip' = page_invocation.PageMap word cap (idle_thread s, b) (Inr (ab, [sl])); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (idle_thread s, b)) [transform_pd_slot_ref sl]; vs_cap_ref cap.NullCap = None \<or> same_refs (Inr (ab, [sl])) cap.NullCap s; same_refs (Inr (ab, [sl])) cap s; s \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd s; wellformed_pde ab; valid_pde ab s; valid_pspace s; (ref \<rhd> (sl && ~~ mask pd_bits)) s; obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (arch_kernel_obj.PageDirectory pd) \<and> pde_range_sz (pd (UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) && ~~ mask 4)) = 0) (sl && ~~ mask pd_bits) s; pde_range_sz ab = 0; is_arch_update cap cap.NullCap; caps_of_state s (idle_thread s, b) = Some cap.NullCap; is_pg_cap cap.NullCap; caps_of_state s (aa, ba) = Some capc; parent_for_refs (Inr (ab, [sl])) capc; valid_mdb s; pde_at sl s; UCAST(32 \<rightarrow> 12) (sl && mask pd_bits >> 2) \<notin> kernel_mapping_slots; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; capa = cap.NullCap\<rbrakk> \<Longrightarrow> False
 2. \<And>word cap a b aa ba pd ab bb s. \<lbrakk>\<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s) (a, b) s; cte_wp_at is_pg_cap (a, b) s; same_refs (Inr (ab, bb)) cap s; s \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s; vspace_at_asid word pd s; invs s; \<forall>sl. bb \<noteq> [sl]; bb \<noteq> []; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; wellformed_pde ab; valid_pde ab s; \<exists>p. is_aligned p 6 \<and> bb = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C] \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (arch_kernel_obj.PageDirectory pd) \<and> (\<forall>x\<in>set (tl bb). pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (hd bb && ~~ mask pd_bits) s\<rbrakk> \<Longrightarrow> valid_idle s \<and> a \<noteq> idle_thread s \<and> valid_idle s
 3. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (3 subgoals):
 1. \<And>word cap a b aa ba pd ab bb s. \<lbrakk>\<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; ip' = page_invocation.PageMap word cap (a, b) (Inr (ab, bb)); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (a, b)) [transform_pd_slot_ref (hd bb)]; cte_wp_at (is_arch_update cap) (a, b) s; cte_wp_at (\<lambda>c. vs_cap_ref c = None) (a, b) s \<or> cte_wp_at (\<lambda>c. same_refs (Inr (ab, bb)) c s) (a, b) s; cte_wp_at is_pg_cap (a, b) s; same_refs (Inr (ab, bb)) cap s; s \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; cte_wp_at (parent_for_refs (Inr (ab, bb))) (aa, ba) s; vspace_at_asid word pd s; invs s; \<forall>sl. bb \<noteq> [sl]; bb \<noteq> []; \<forall>p\<in>set bb. (\<exists>ref. (ref \<rhd> (p && ~~ mask pd_bits)) s) \<and> pde_at p s \<and> UCAST(32 \<rightarrow> 12) (p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; wellformed_pde ab; valid_pde ab s; \<exists>p. is_aligned p 6 \<and> bb = map (\<lambda>x. x + p) [0 , 4 .e. 0x3C] \<and> obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (arch_kernel_obj.PageDirectory pd) \<and> (\<forall>x\<in>set (tl bb). pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (hd bb && ~~ mask pd_bits) s\<rbrakk> \<Longrightarrow> valid_idle s \<and> a \<noteq> idle_thread s \<and> valid_idle s
 2. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (3 subgoals):
 1. \<And>word cap b aa ba pd ab s capa capc p. \<lbrakk>\<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; ip' = page_invocation.PageMap word cap (idle_thread s, b) (Inr (ab, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (idle_thread s, b)) [transform_pd_slot_ref (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))]; vs_cap_ref capa = None \<or> same_refs (Inr (ab, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) capa s; same_refs (Inr (ab, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) cap s; s \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd s; \<forall>sl. map (\<lambda>x. x + p) [0 , 4 .e. 0x3C] \<noteq> [sl]; \<forall>pa\<in>set [0 , 4 .e. 0x3C]. (\<exists>ref. (ref \<rhd> (pa + p && ~~ mask pd_bits)) s) \<and> pde_at (pa + p) s \<and> UCAST(32 \<rightarrow> 12) (pa + p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; wellformed_pde ab; valid_pde ab s; valid_pspace s; is_arch_update cap capa; caps_of_state s (idle_thread s, b) = Some capa; is_pg_cap capa; caps_of_state s (aa, ba) = Some capc; parent_for_refs (Inr (ab, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) capc; is_aligned p 6; valid_mdb s; obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (arch_kernel_obj.PageDirectory pd) \<and> (\<forall>x\<in>set (tl (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])). pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]) && ~~ mask pd_bits) s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; [0 , 4 .e. 0x3C] \<noteq> []\<rbrakk> \<Longrightarrow> False
 2. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (3 subgoals):
 1. \<And>word cap b aa ba pd ab s capa capc p. \<lbrakk>\<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; ip' = page_invocation.PageMap word cap (idle_thread s, b) (Inr (ab, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])); ip = cdl_page_invocation.PageMap (transform_cap cap) (transform_pde ab) (transform_cslot_ptr (idle_thread s, b)) [transform_pd_slot_ref (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]))]; vs_cap_ref cap.NullCap = None \<or> same_refs (Inr (ab, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) cap.NullCap s; same_refs (Inr (ab, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) cap s; s \<turnstile> cap; is_pg_cap cap; pde_ref ab = None; word \<le> mask local.asid_bits; word \<noteq> 0; vspace_at_asid word pd s; \<forall>sl. map (\<lambda>x. x + p) [0 , 4 .e. 0x3C] \<noteq> [sl]; \<forall>pa\<in>set [0 , 4 .e. 0x3C]. (\<exists>ref. (ref \<rhd> (pa + p && ~~ mask pd_bits)) s) \<and> pde_at (pa + p) s \<and> UCAST(32 \<rightarrow> 12) (pa + p && mask pd_bits >> 2) \<notin> kernel_mapping_slots; wellformed_pde ab; valid_pde ab s; valid_pspace s; is_arch_update cap cap.NullCap; caps_of_state s (idle_thread s, b) = Some cap.NullCap; is_pg_cap cap.NullCap; caps_of_state s (aa, ba) = Some capc; parent_for_refs (Inr (ab, map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])) capc; is_aligned p 6; valid_mdb s; obj_at (\<lambda>ko. \<exists>pd. ko = ArchObj (arch_kernel_obj.PageDirectory pd) \<and> (\<forall>x\<in>set (tl (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C])). pd (UCAST(32 \<rightarrow> 12) (x && mask pd_bits >> 2)) = InvalidPDE)) (hd (map (\<lambda>x. x + p) [0 , 4 .e. 0x3C]) && ~~ mask pd_bits) s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; [0 , 4 .e. 0x3C] \<noteq> []; capa = cap.NullCap\<rbrakk> \<Longrightarrow> False
 2. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x22. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 2. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x22 s s'. \<lbrakk>(case x21 of PageCap x a xa sz asid \<Rightarrow> Some (cdl_page_invocation.PageUnmap (transform_mapping asid) a (transform_cslot_ptr x22) (pageBitsForSize sz)) | _ \<Rightarrow> None) = Some ip; ip' = page_invocation.PageUnmap x21 x22; s = transform s'; True; (valid_page_inv (page_invocation.PageUnmap x21 x22) and invs and page_inv_duplicates_valid (page_invocation.PageUnmap x21 x22) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s') (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (case x21 of PageCap dev p R vp_size vp_mapped_addr \<Rightarrow> do case vp_mapped_addr of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> local.unmap_page vp_size asid vaddr p;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap x22;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) x22;
return []
od | _ \<Rightarrow> fail)
 2. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (3 subgoals):
 1. \<And>a b s' x31 x32 x33 x34. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do x <- CSpaceAcc_A.get_cap (a, b);
y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 2. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34);
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- local.unmap_page x34 ab bb x32;
x <- CSpaceAcc_A.get_cap (a, b);
y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (5 subgoals):
 1. \<And>a b s' x31 x32 x33 x34. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> dcorres dc (?Q968 a b s' x31 x32 x33 x34) (?Q'968 a b s' x31 x32 x33 x34) (do cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do x <- CSpaceAcc_A.get_cap (a, b);
y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 2. \<And>a b s' x31 x32 x33 x34 s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); transform s' = s\<rbrakk> \<Longrightarrow> ?Q968 a b s' x31 x32 x33 x34 s
 3. \<And>a b s' x31 x32 x33 x34 s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); s' = s\<rbrakk> \<Longrightarrow> ?Q'968 a b s' x31 x32 x33 x34 s
 4. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34);
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- local.unmap_page x34 ab bb x32;
x <- CSpaceAcc_A.get_cap (a, b);
y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 5. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (8 subgoals):
 1. \<And>a b s' x31 x32 x33 x34. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> dcorres (?r'972 a b s' x31 x32 x33 x34) (?P972 a b s' x31 x32 x33 x34) (?P'972 a b s' x31 x32 x33 x34) (KHeap_D.get_cap (transform_cslot_ptr (a, b))) (CSpaceAcc_A.get_cap (a, b))
 2. \<And>a b s' x31 x32 x33 x34 cap x. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); ?r'972 a b s' x31 x32 x33 x34 cap x\<rbrakk> \<Longrightarrow> dcorres dc (?R972 a b s' x31 x32 x33 x34 cap) (?R'972 a b s' x31 x32 x33 x34 x) (KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)) (do y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 3. \<And>a b s' x31 x32 x33 x34. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q972 a b s' x31 x32 x33 x34\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>?R972 a b s' x31 x32 x33 x34\<rbrace>
 4. \<And>a b s' x31 x32 x33 x34. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'972 a b s' x31 x32 x33 x34\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>?R'972 a b s' x31 x32 x33 x34\<rbrace>
 5. \<And>a b s' x31 x32 x33 x34 s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); transform s' = s\<rbrakk> \<Longrightarrow> (?P972 a b s' x31 x32 x33 x34 and ?Q972 a b s' x31 x32 x33 x34) s
 6. \<And>a b s' x31 x32 x33 x34 s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); s' = s\<rbrakk> \<Longrightarrow> (?P'972 a b s' x31 x32 x33 x34 and ?Q'972 a b s' x31 x32 x33 x34) s
 7. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34);
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- local.unmap_page x34 ab bb x32;
x <- CSpaceAcc_A.get_cap (a, b);
y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (7 subgoals):
 1. \<And>a b s' x31 x32 x33 x34 cap x. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); cap = transform_cap x\<rbrakk> \<Longrightarrow> dcorres dc (?R972 a b s' x31 x32 x33 x34 cap) (?R'972 a b s' x31 x32 x33 x34 x) (KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)) (do y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 2. \<And>a b s' x31 x32 x33 x34. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q972 a b s' x31 x32 x33 x34\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>?R972 a b s' x31 x32 x33 x34\<rbrace>
 3. \<And>a b s' x31 x32 x33 x34. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'972 a b s' x31 x32 x33 x34\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>?R'972 a b s' x31 x32 x33 x34\<rbrace>
 4. \<And>a b s' x31 x32 x33 x34 s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q972 a b s' x31 x32 x33 x34) s
 5. \<And>a b s' x31 x32 x33 x34 s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst (a, b)) and valid_etcbs and ?Q'972 a b s' x31 x32 x33 x34) s
 6. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34);
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- local.unmap_page x34 ab bb x32;
x <- CSpaceAcc_A.get_cap (a, b);
y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (7 subgoals):
 1. \<And>a b s' x31 x32 x33 x34 cap x. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); cap = transform_cap x\<rbrakk> \<Longrightarrow> dcorres (?r'985 a b s' x31 x32 x33 x34 cap x) (?R972 a b s' x31 x32 x33 x34 cap) (?R'972 a b s' x31 x32 x33 x34 x) (KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)) (CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b))
 2. \<And>a b s' x31 x32 x33 x34. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q972 a b s' x31 x32 x33 x34\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>?R972 a b s' x31 x32 x33 x34\<rbrace>
 3. \<And>a b s' x31 x32 x33 x34. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'972 a b s' x31 x32 x33 x34\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>?R'972 a b s' x31 x32 x33 x34\<rbrace>
 4. \<And>a b s' x31 x32 x33 x34 s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q972 a b s' x31 x32 x33 x34) s
 5. \<And>a b s' x31 x32 x33 x34 s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst (a, b)) and valid_etcbs and ?Q'972 a b s' x31 x32 x33 x34) s
 6. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34);
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- local.unmap_page x34 ab bb x32;
x <- CSpaceAcc_A.get_cap (a, b);
y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (8 subgoals):
 1. \<And>a b s' x31 x32 x33 x34 cap x s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); cap = transform_cap x; cte_wp_at ((=) x) (a, b) s \<and> s = s'\<rbrakk> \<Longrightarrow> reset_mem_mapping cap = transform_cap (ArchObjectCap (update_map_data (the_arch_cap x) None))
 2. \<And>a b s' x31 x32 x33 x34 cap x. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); cap = transform_cap x\<rbrakk> \<Longrightarrow> transform_cslot_ptr (a, b) = transform_cslot_ptr (a, b)
 3. \<And>a b s' x31 x32 x33 x34. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q972 a b s' x31 x32 x33 x34\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>\<lambda>cap _. True\<rbrace>
 4. \<And>a b s' x31 x32 x33 x34. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'972 a b s' x31 x32 x33 x34\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>\<lambda>x s. (cte_wp_at ((=) x) (a, b) s \<and> s = s') \<and> valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 5. \<And>a b s' x31 x32 x33 x34 s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q972 a b s' x31 x32 x33 x34) s
 6. \<And>a b s' x31 x32 x33 x34 s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst (a, b)) and valid_etcbs and ?Q'972 a b s' x31 x32 x33 x34) s
 7. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34);
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- local.unmap_page x34 ab bb x32;
x <- CSpaceAcc_A.get_cap (a, b);
y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (8 subgoals):
 1. \<And>a b s' x31 x32 x33 x34 x. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); cte_wp_at ((=) x) (a, b) s'\<rbrakk> \<Longrightarrow> reset_mem_mapping (transform_cap x) = transform_cap (ArchObjectCap (update_map_data (the_arch_cap x) None))
 2. \<And>a b s' x31 x32 x33 x34 cap x. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); cap = transform_cap x\<rbrakk> \<Longrightarrow> transform_cslot_ptr (a, b) = transform_cslot_ptr (a, b)
 3. \<And>a b s' x31 x32 x33 x34. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q972 a b s' x31 x32 x33 x34\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>\<lambda>cap _. True\<rbrace>
 4. \<And>a b s' x31 x32 x33 x34. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'972 a b s' x31 x32 x33 x34\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>\<lambda>x s. (cte_wp_at ((=) x) (a, b) s \<and> s = s') \<and> valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 5. \<And>a b s' x31 x32 x33 x34 s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q972 a b s' x31 x32 x33 x34) s
 6. \<And>a b s' x31 x32 x33 x34 s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst (a, b)) and valid_etcbs and ?Q'972 a b s' x31 x32 x33 x34) s
 7. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34);
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- local.unmap_page x34 ab bb x32;
x <- CSpaceAcc_A.get_cap (a, b);
y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (8 subgoals):
 1. \<And>a b s' x31 x32 x33 x34 x. \<lbrakk>s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); cte_wp_at ((=) x) (a, b) s'; x = ArchObjectCap (PageCap x31 x32 x33 x34 None)\<rbrakk> \<Longrightarrow> reset_mem_mapping (transform_cap x) = transform_cap (ArchObjectCap (update_map_data (the_arch_cap x) None))
 2. \<And>a b s' x31 x32 x33 x34 cap x. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); cap = transform_cap x\<rbrakk> \<Longrightarrow> transform_cslot_ptr (a, b) = transform_cslot_ptr (a, b)
 3. \<And>a b s' x31 x32 x33 x34. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q972 a b s' x31 x32 x33 x34\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>\<lambda>cap _. True\<rbrace>
 4. \<And>a b s' x31 x32 x33 x34. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'972 a b s' x31 x32 x33 x34\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>\<lambda>x s. (cte_wp_at ((=) x) (a, b) s \<and> s = s') \<and> valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 5. \<And>a b s' x31 x32 x33 x34 s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q972 a b s' x31 x32 x33 x34) s
 6. \<And>a b s' x31 x32 x33 x34 s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst (a, b)) and valid_etcbs and ?Q'972 a b s' x31 x32 x33 x34) s
 7. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34);
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- local.unmap_page x34 ab bb x32;
x <- CSpaceAcc_A.get_cap (a, b);
y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (7 subgoals):
 1. \<And>a b s' x31 x32 x33 x34 cap x. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); cap = transform_cap x\<rbrakk> \<Longrightarrow> transform_cslot_ptr (a, b) = transform_cslot_ptr (a, b)
 2. \<And>a b s' x31 x32 x33 x34. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q972 a b s' x31 x32 x33 x34\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>\<lambda>cap _. True\<rbrace>
 3. \<And>a b s' x31 x32 x33 x34. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'972 a b s' x31 x32 x33 x34\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>\<lambda>x s. (cte_wp_at ((=) x) (a, b) s \<and> s = s') \<and> valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 4. \<And>a b s' x31 x32 x33 x34 s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q972 a b s' x31 x32 x33 x34) s
 5. \<And>a b s' x31 x32 x33 x34 s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst (a, b)) and valid_etcbs and ?Q'972 a b s' x31 x32 x33 x34) s
 6. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34);
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- local.unmap_page x34 ab bb x32;
x <- CSpaceAcc_A.get_cap (a, b);
y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (3 subgoals):
 1. \<And>a b x31 x32 x33 x34 s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 None))) (a, b) s; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> valid_idle s \<and> not_idle_thread a s \<and> cte_wp_at (\<lambda>cap. True) (a, b) s \<and> valid_idle s \<and> a \<noteq> idle_thread s
 2. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34);
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- local.unmap_page x34 ab bb x32;
x <- CSpaceAcc_A.get_cap (a, b);
y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (3 subgoals):
 1. \<And>a b x31 x32 x33 x34 s. \<lbrakk>fst (CSpaceAcc_A.get_cap (a, b) s) = {(ArchObjectCap (PageCap x31 x32 x33 x34 None), s)}; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b); invs s; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (a, b)) s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> valid_idle s \<and> not_idle_thread a s \<and> valid_idle s \<and> a \<noteq> idle_thread s
 2. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34);
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- local.unmap_page x34 ab bb x32;
x <- CSpaceAcc_A.get_cap (a, b);
y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (3 subgoals):
 1. \<And>b x31 x32 x33 x34 s. \<lbrakk>fst (CSpaceAcc_A.get_cap (idle_thread s, b) s) = {(ArchObjectCap (PageCap x31 x32 x33 x34 None), s)}; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (idle_thread s, b); page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (idle_thread s, b)) s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (idle_thread s, b)) (pageBitsForSize x34); valid_pspace s; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s\<rbrakk> \<Longrightarrow> False
 2. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34);
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- local.unmap_page x34 ab bb x32;
x <- CSpaceAcc_A.get_cap (a, b);
y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (4 subgoals):
 1. \<And>b x31 x32 x33 x34 s. \<lbrakk>fst (CSpaceAcc_A.get_cap (idle_thread s, b) s) = {(ArchObjectCap (PageCap x31 x32 x33 x34 None), s)}; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (idle_thread s, b); page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (idle_thread s, b)) s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (idle_thread s, b)) (pageBitsForSize x34); valid_pspace s; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s\<rbrakk> \<Longrightarrow> caps_of_state s (idle_thread s, ?v1039 b x31 x32 x33 x34 s) = Some (?cap1039 b x31 x32 x33 x34 s)
 2. \<And>b x31 x32 x33 x34 s. \<lbrakk>fst (CSpaceAcc_A.get_cap (idle_thread s, b) s) = {(ArchObjectCap (PageCap x31 x32 x33 x34 None), s)}; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (idle_thread s, b); page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (idle_thread s, b)) s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (idle_thread s, b)) (pageBitsForSize x34); valid_pspace s; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; ?cap1039 b x31 x32 x33 x34 s = cap.NullCap\<rbrakk> \<Longrightarrow> False
 3. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34);
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- local.unmap_page x34 ab bb x32;
x <- CSpaceAcc_A.get_cap (a, b);
y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (4 subgoals):
 1. \<And>b x31 x32 x33 x34 s. \<lbrakk>fst (CSpaceAcc_A.get_cap (idle_thread s, b) s) = {(ArchObjectCap (PageCap x31 x32 x33 x34 None), s)}; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (idle_thread s, b); page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (idle_thread s, b)) s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (idle_thread s, b)) (pageBitsForSize x34); valid_pspace s; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s\<rbrakk> \<Longrightarrow> Some (?cap1039 b x31 x32 x33 x34 s) = caps_of_state s (idle_thread s, ?v1039 b x31 x32 x33 x34 s)
 2. \<And>b x31 x32 x33 x34 s. \<lbrakk>fst (CSpaceAcc_A.get_cap (idle_thread s, b) s) = {(ArchObjectCap (PageCap x31 x32 x33 x34 None), s)}; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 None); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (idle_thread s, b); page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 None) (idle_thread s, b)) s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; ip = cdl_page_invocation.PageUnmap None x32 (transform_cslot_ptr (idle_thread s, b)) (pageBitsForSize x34); valid_pspace s; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; ?cap1039 b x31 x32 x33 x34 s = cap.NullCap\<rbrakk> \<Longrightarrow> False
 3. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34);
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- local.unmap_page x34 ab bb x32;
x <- CSpaceAcc_A.get_cap (a, b);
y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (2 subgoals):
 1. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34);
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- local.unmap_page x34 ab bb x32;
x <- CSpaceAcc_A.get_cap (a, b);
y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 2. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (4 subgoals):
 1. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> dcorres dc (?Q1047 a b s' x31 x32 x33 x34 ab bb) (?Q'1047 a b s' x31 x32 x33 x34 ab bb) (do y <- PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34);
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- local.unmap_page x34 ab bb x32;
x <- CSpaceAcc_A.get_cap (a, b);
y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 2. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); transform s' = s\<rbrakk> \<Longrightarrow> ?Q1047 a b s' x31 x32 x33 x34 ab bb s
 3. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); s' = s\<rbrakk> \<Longrightarrow> ?Q'1047 a b s' x31 x32 x33 x34 ab bb s
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (6 subgoals):
 1. \<And>a b s' x31 x32 x33 x34 ab bb y ya. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); dc y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R1051 a b s' x31 x32 x33 x34 ab bb y) (?R'1051 a b s' x31 x32 x33 x34 ab bb ya) (do cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do x <- CSpaceAcc_A.get_cap (a, b);
y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 2. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q1051 a b s' x31 x32 x33 x34 ab bb\<rbrace> PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34) \<lbrace>?R1051 a b s' x31 x32 x33 x34 ab bb\<rbrace>
 3. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1051 a b s' x31 x32 x33 x34 ab bb\<rbrace> local.unmap_page x34 ab bb x32 \<lbrace>?R'1051 a b s' x31 x32 x33 x34 ab bb\<rbrace>
 4. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1051 a b s' x31 x32 x33 x34 ab bb) s
 5. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); s' = s\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_cap (ArchObjectCap (PageCap (?dev1052 a b s' x31 x32 x33 x34 ab bb) x32 (?fun1052 a b s' x31 x32 x33 x34 ab bb) x34 (Some (ab, bb)))) and ?Q'1051 a b s' x31 x32 x33 x34 ab bb) s
 6. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (9 subgoals):
 1. \<And>a b s' x31 x32 x33 x34 ab bb y ya. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); dc y ya\<rbrakk> \<Longrightarrow> dcorres (?r'1056 a b s' x31 x32 x33 x34 ab bb y ya) (?P1057 a b s' x31 x32 x33 x34 ab bb y) (?P'1059 a b s' x31 x32 x33 x34 ab bb ya) (KHeap_D.get_cap (transform_cslot_ptr (a, b))) (CSpaceAcc_A.get_cap (a, b))
 2. \<And>a b s' x31 x32 x33 x34 ab bb y ya cap x. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); dc y ya; ?r'1056 a b s' x31 x32 x33 x34 ab bb y ya cap x\<rbrakk> \<Longrightarrow> dcorres dc (?R1056 a b s' x31 x32 x33 x34 ab bb y ya cap) (?R'1056 a b s' x31 x32 x33 x34 ab bb y ya x) (KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)) (do y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 3. \<And>a b s' x31 x32 x33 x34 ab bb y ya. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1058 a b s' x31 x32 x33 x34 ab bb y\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>?R1056 a b s' x31 x32 x33 x34 ab bb y ya\<rbrace>
 4. \<And>a b s' x31 x32 x33 x34 ab bb y ya. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1060 a b s' x31 x32 x33 x34 ab bb ya\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>?R'1056 a b s' x31 x32 x33 x34 ab bb y ya\<rbrace>
 5. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q1051 a b s' x31 x32 x33 x34 ab bb\<rbrace> PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34) \<lbrace>\<lambda>y. ?P1057 a b s' x31 x32 x33 x34 ab bb y and ?Q1058 a b s' x31 x32 x33 x34 ab bb y\<rbrace>
 6. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1051 a b s' x31 x32 x33 x34 ab bb\<rbrace> local.unmap_page x34 ab bb x32 \<lbrace>\<lambda>ya. ?P'1059 a b s' x31 x32 x33 x34 ab bb ya and ?Q'1060 a b s' x31 x32 x33 x34 ab bb ya\<rbrace>
 7. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1051 a b s' x31 x32 x33 x34 ab bb) s
 8. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); s' = s\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_cap (ArchObjectCap (PageCap (?dev1052 a b s' x31 x32 x33 x34 ab bb) x32 (?fun1052 a b s' x31 x32 x33 x34 ab bb) x34 (Some (ab, bb)))) and ?Q'1051 a b s' x31 x32 x33 x34 ab bb) s
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (8 subgoals):
 1. \<And>a b s' x31 x32 x33 x34 ab bb y ya cap x. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); dc y ya; cap = transform_cap x\<rbrakk> \<Longrightarrow> dcorres dc (?R1056 a b s' x31 x32 x33 x34 ab bb y ya cap) (?R'1056 a b s' x31 x32 x33 x34 ab bb y ya x) (KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)) (do y <- CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b);
return []
od)
 2. \<And>a b s' x31 x32 x33 x34 ab bb y ya. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1058 a b s' x31 x32 x33 x34 ab bb y\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>?R1056 a b s' x31 x32 x33 x34 ab bb y ya\<rbrace>
 3. \<And>a b s' x31 x32 x33 x34 ab bb y ya. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1060 a b s' x31 x32 x33 x34 ab bb ya\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>?R'1056 a b s' x31 x32 x33 x34 ab bb y ya\<rbrace>
 4. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q1051 a b s' x31 x32 x33 x34 ab bb\<rbrace> PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1058 a b s' x31 x32 x33 x34 ab bb y\<rbrace>
 5. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1051 a b s' x31 x32 x33 x34 ab bb\<rbrace> local.unmap_page x34 ab bb x32 \<lbrace>\<lambda>ya. valid_idle and not_idle_thread (fst (a, b)) and valid_etcbs and ?Q'1060 a b s' x31 x32 x33 x34 ab bb ya\<rbrace>
 6. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1051 a b s' x31 x32 x33 x34 ab bb) s
 7. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); s' = s\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_cap (ArchObjectCap (PageCap (?dev1052 a b s' x31 x32 x33 x34 ab bb) x32 (?fun1052 a b s' x31 x32 x33 x34 ab bb) x34 (Some (ab, bb)))) and ?Q'1051 a b s' x31 x32 x33 x34 ab bb) s
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (8 subgoals):
 1. \<And>a b s' x31 x32 x33 x34 ab bb y ya cap x. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); dc y ya; cap = transform_cap x\<rbrakk> \<Longrightarrow> dcorres (?r'1074 a b s' x31 x32 x33 x34 ab bb y ya cap x) (?R1056 a b s' x31 x32 x33 x34 ab bb y ya cap) (?R'1056 a b s' x31 x32 x33 x34 ab bb y ya x) (KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)) (CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b))
 2. \<And>a b s' x31 x32 x33 x34 ab bb y ya. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1058 a b s' x31 x32 x33 x34 ab bb y\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>?R1056 a b s' x31 x32 x33 x34 ab bb y ya\<rbrace>
 3. \<And>a b s' x31 x32 x33 x34 ab bb y ya. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1060 a b s' x31 x32 x33 x34 ab bb ya\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>?R'1056 a b s' x31 x32 x33 x34 ab bb y ya\<rbrace>
 4. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q1051 a b s' x31 x32 x33 x34 ab bb\<rbrace> PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1058 a b s' x31 x32 x33 x34 ab bb y\<rbrace>
 5. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1051 a b s' x31 x32 x33 x34 ab bb\<rbrace> local.unmap_page x34 ab bb x32 \<lbrace>\<lambda>ya. valid_idle and not_idle_thread (fst (a, b)) and valid_etcbs and ?Q'1060 a b s' x31 x32 x33 x34 ab bb ya\<rbrace>
 6. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1051 a b s' x31 x32 x33 x34 ab bb) s
 7. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); s' = s\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_cap (ArchObjectCap (PageCap (?dev1052 a b s' x31 x32 x33 x34 ab bb) x32 (?fun1052 a b s' x31 x32 x33 x34 ab bb) x34 (Some (ab, bb)))) and ?Q'1051 a b s' x31 x32 x33 x34 ab bb) s
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (9 subgoals):
 1. \<And>a b s' x31 x32 x33 x34 ab bb y ya cap x s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); dc y ya; cap = transform_cap x; cte_wp_at ((=) x) (a, b) s \<and> caps_of_state s' = caps_of_state s\<rbrakk> \<Longrightarrow> reset_mem_mapping cap = transform_cap (ArchObjectCap (update_map_data (the_arch_cap x) None))
 2. \<And>a b s' x31 x32 x33 x34 ab bb y ya cap x. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); dc y ya; cap = transform_cap x\<rbrakk> \<Longrightarrow> transform_cslot_ptr (a, b) = transform_cslot_ptr (a, b)
 3. \<And>a b s' x31 x32 x33 x34 ab bb y ya. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1058 a b s' x31 x32 x33 x34 ab bb y\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>\<lambda>cap _. True\<rbrace>
 4. \<And>a b s' x31 x32 x33 x34 ab bb y ya. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1060 a b s' x31 x32 x33 x34 ab bb ya\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>\<lambda>x s. (cte_wp_at ((=) x) (a, b) s \<and> caps_of_state s' = caps_of_state s) \<and> valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 5. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q1051 a b s' x31 x32 x33 x34 ab bb\<rbrace> PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1058 a b s' x31 x32 x33 x34 ab bb y\<rbrace>
 6. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1051 a b s' x31 x32 x33 x34 ab bb\<rbrace> local.unmap_page x34 ab bb x32 \<lbrace>\<lambda>ya. valid_idle and not_idle_thread (fst (a, b)) and valid_etcbs and ?Q'1060 a b s' x31 x32 x33 x34 ab bb ya\<rbrace>
 7. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1051 a b s' x31 x32 x33 x34 ab bb) s
 8. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); s' = s\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_cap (ArchObjectCap (PageCap (?dev1052 a b s' x31 x32 x33 x34 ab bb) x32 (?fun1052 a b s' x31 x32 x33 x34 ab bb) x34 (Some (ab, bb)))) and ?Q'1051 a b s' x31 x32 x33 x34 ab bb) s
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (9 subgoals):
 1. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>caps_of_state s (a, b) = Some (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb)))); s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); caps_of_state s' = caps_of_state s\<rbrakk> \<Longrightarrow> FrameCap x31 x32 x33 (pageBitsForSize x34) Real None = transform_cap (ArchObjectCap (update_map_data (PageCap x31 x32 x33 x34 (Some (ab, bb))) None))
 2. \<And>a b s' x31 x32 x33 x34 ab bb y ya cap x. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); dc y ya; cap = transform_cap x\<rbrakk> \<Longrightarrow> transform_cslot_ptr (a, b) = transform_cslot_ptr (a, b)
 3. \<And>a b s' x31 x32 x33 x34 ab bb y ya. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1058 a b s' x31 x32 x33 x34 ab bb y\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>\<lambda>cap _. True\<rbrace>
 4. \<And>a b s' x31 x32 x33 x34 ab bb y ya. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1060 a b s' x31 x32 x33 x34 ab bb ya\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>\<lambda>x s. (cte_wp_at ((=) x) (a, b) s \<and> caps_of_state s' = caps_of_state s) \<and> valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 5. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q1051 a b s' x31 x32 x33 x34 ab bb\<rbrace> PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1058 a b s' x31 x32 x33 x34 ab bb y\<rbrace>
 6. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1051 a b s' x31 x32 x33 x34 ab bb\<rbrace> local.unmap_page x34 ab bb x32 \<lbrace>\<lambda>ya. valid_idle and not_idle_thread (fst (a, b)) and valid_etcbs and ?Q'1060 a b s' x31 x32 x33 x34 ab bb ya\<rbrace>
 7. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1051 a b s' x31 x32 x33 x34 ab bb) s
 8. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); s' = s\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_cap (ArchObjectCap (PageCap (?dev1052 a b s' x31 x32 x33 x34 ab bb) x32 (?fun1052 a b s' x31 x32 x33 x34 ab bb) x34 (Some (ab, bb)))) and ?Q'1051 a b s' x31 x32 x33 x34 ab bb) s
 9. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (8 subgoals):
 1. \<And>a b s' x31 x32 x33 x34 ab bb y ya cap x. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); dc y ya; cap = transform_cap x\<rbrakk> \<Longrightarrow> transform_cslot_ptr (a, b) = transform_cslot_ptr (a, b)
 2. \<And>a b s' x31 x32 x33 x34 ab bb y ya. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q1058 a b s' x31 x32 x33 x34 ab bb y\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>\<lambda>cap _. True\<rbrace>
 3. \<And>a b s' x31 x32 x33 x34 ab bb y ya. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1060 a b s' x31 x32 x33 x34 ab bb ya\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>\<lambda>x s. (cte_wp_at ((=) x) (a, b) s \<and> caps_of_state s' = caps_of_state s) \<and> valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 4. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q1051 a b s' x31 x32 x33 x34 ab bb\<rbrace> PageTableUnmap_D.unmap_page (transform_asid ab, bb) x32 (pageBitsForSize x34) \<lbrace>\<lambda>y. (\<lambda>_. True) and ?Q1058 a b s' x31 x32 x33 x34 ab bb y\<rbrace>
 5. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1051 a b s' x31 x32 x33 x34 ab bb\<rbrace> local.unmap_page x34 ab bb x32 \<lbrace>\<lambda>ya. valid_idle and not_idle_thread (fst (a, b)) and valid_etcbs and ?Q'1060 a b s' x31 x32 x33 x34 ab bb ya\<rbrace>
 6. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q1051 a b s' x31 x32 x33 x34 ab bb) s
 7. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); s' = s\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_cap (ArchObjectCap (PageCap (?dev1052 a b s' x31 x32 x33 x34 ab bb) x32 (?fun1052 a b s' x31 x32 x33 x34 ab bb) x34 (Some (ab, bb)))) and ?Q'1051 a b s' x31 x32 x33 x34 ab bb) s
 8. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (4 subgoals):
 1. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1051 a b s' x31 x32 x33 x34 ab bb\<rbrace> local.unmap_page x34 ab bb x32 \<lbrace>\<lambda>ya s. idle_tcb_at (\<lambda>(st, ab). idle st \<and> (case ab of (ntfn, arch) \<Rightarrow> ntfn = None \<and> valid_arch_idle arch)) (idle_thread s) s \<and> idle_thread s = idle_thread_ptr \<and> a \<noteq> idle_thread s \<and> valid_etcbs s \<and> cte_wp_at (\<lambda>cap. True) (a, b) s \<and> caps_of_state s' = caps_of_state s \<and> idle_tcb_at (\<lambda>(st, ab). idle st \<and> (case ab of (ntfn, arch) \<Rightarrow> ntfn = None \<and> valid_arch_idle arch)) (idle_thread s) s \<and> idle_thread s = idle_thread_ptr \<and> a \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 2. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> ?P'1095 a b s' x31 x32 x33 x34 ab bb s)) s
 3. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); s' = s\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_cap (ArchObjectCap (PageCap (?dev1052 a b s' x31 x32 x33 x34 ab bb) x32 (?fun1052 a b s' x31 x32 x33 x34 ab bb) x34 (Some (ab, bb)))) and ?Q'1051 a b s' x31 x32 x33 x34 ab bb) s
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (5 subgoals):
 1. \<And>a b s' x31 x32 x33 x34 ab bb. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1051 a b s' x31 x32 x33 x34 ab bb\<rbrace> local.unmap_page x34 ab bb x32 \<lbrace>\<lambda>rv s. valid_etcbs s \<and> idle_tcb_at (\<lambda>(st, ntfn, arch). idle st \<and> ntfn = None \<and> valid_arch_idle arch) (idle_thread s) s \<and> a \<noteq> idle_thread s \<and> idle_thread s = idle_thread_ptr \<and> cte_wp_at (\<lambda>_. True) (a, b) s \<and> caps_of_state s' = caps_of_state s\<rbrace>
 2. \<And>a b s' x31 x32 x33 x34 ab bb rv s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); valid_etcbs s \<and> idle_tcb_at (\<lambda>(st, ntfn, arch). idle st \<and> ntfn = None \<and> valid_arch_idle arch) (idle_thread s) s \<and> a \<noteq> idle_thread s \<and> idle_thread s = idle_thread_ptr \<and> cte_wp_at (\<lambda>_. True) (a, b) s \<and> caps_of_state s' = caps_of_state s\<rbrakk> \<Longrightarrow> idle_tcb_at (\<lambda>(st, ab). idle st \<and> (case ab of (ntfn, arch) \<Rightarrow> ntfn = None \<and> valid_arch_idle arch)) (idle_thread s) s \<and> idle_thread s = idle_thread_ptr \<and> a \<noteq> idle_thread s \<and> valid_etcbs s \<and> cte_wp_at (\<lambda>cap. True) (a, b) s \<and> caps_of_state s' = caps_of_state s \<and> idle_tcb_at (\<lambda>(st, ab). idle st \<and> (case ab of (ntfn, arch) \<Rightarrow> ntfn = None \<and> valid_arch_idle arch)) (idle_thread s) s \<and> idle_thread s = idle_thread_ptr \<and> a \<noteq> idle_thread s \<and> valid_etcbs s
 3. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> ?P'1095 a b s' x31 x32 x33 x34 ab bb s)) s
 4. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); s' = s\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_cap (ArchObjectCap (PageCap (?dev1052 a b s' x31 x32 x33 x34 ab bb) x32 (?fun1052 a b s' x31 x32 x33 x34 ab bb) x34 (Some (ab, bb)))) and ?Q'1051 a b s' x31 x32 x33 x34 ab bb) s
 5. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (3 subgoals):
 1. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> ?P'1095 a b s' x31 x32 x33 x34 ab bb s)) s
 2. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); s' = s\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_cap (ArchObjectCap (PageCap (?dev1052 a b s' x31 x32 x33 x34 ab bb) x32 (?fun1052 a b s' x31 x32 x33 x34 ab bb) x34 (Some (ab, bb)))) and (\<lambda>s. valid_etcbs s \<and> idle_tcb_at (\<lambda>(st, ntfn, arch). idle st \<and> ntfn = None \<and> valid_arch_idle arch) (idle_thread s) s \<and> a \<noteq> idle_thread s \<and> idle_thread s = idle_thread_ptr \<and> cte_wp_at (\<lambda>_. True) (a, b) s \<and> caps_of_state s' = caps_of_state s)) s
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (2 subgoals):
 1. \<And>a b s' x31 x32 x33 x34 ab bb s. \<lbrakk>cte_wp_at ((=) (ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))))) (a, b) s'; s' \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s'; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s'; \<forall>x\<in>ran (kheap s'). obj_valid_pdpt x; valid_etcbs s'; ct_active s'; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34); s' = s\<rbrakk> \<Longrightarrow> (invs and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_cap (ArchObjectCap (PageCap (?dev1052 a b s' x31 x32 x33 x34 ab bb) x32 (?fun1052 a b s' x31 x32 x33 x34 ab bb) x34 (Some (ab, bb)))) and (\<lambda>s. valid_etcbs s \<and> idle_tcb_at (\<lambda>(st, ntfn, arch). idle st \<and> ntfn = None \<and> valid_arch_idle arch) (idle_thread s) s \<and> a \<noteq> idle_thread s \<and> idle_thread s = idle_thread_ptr \<and> cte_wp_at (\<lambda>_. True) (a, b) s \<and> caps_of_state s' = caps_of_state s)) s
 2. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (2 subgoals):
 1. \<And>a b x31 x32 x33 x34 ab bb s. \<lbrakk>fst (CSpaceAcc_A.get_cap (a, b) s) = {(ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))), s)}; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> s \<turnstile> ArchObjectCap (PageCap (?dev1052 a b s x31 x32 x33 x34 ab bb) x32 (?fun1052 a b s x31 x32 x33 x34 ab bb) x34 (Some (ab, bb))) \<and> idle_tcb_at (\<lambda>(st, ab). idle st \<and> (case ab of (ntfn, arch) \<Rightarrow> ntfn = None \<and> valid_arch_idle arch)) (idle_thread s) s \<and> a \<noteq> idle_thread s \<and> idle_thread s = idle_thread_ptr
 2. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (2 subgoals):
 1. \<And>a b x31 x32 x33 x34 ab bb s. \<lbrakk>fst (CSpaceAcc_A.get_cap (a, b) s) = {(ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))), s)}; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> idle_tcb_at (\<lambda>(st, ab). idle st \<and> (case ab of (ntfn, arch) \<Rightarrow> ntfn = None \<and> valid_arch_idle arch)) (idle_thread s) s \<and> a \<noteq> idle_thread s \<and> idle_thread s = idle_thread_ptr
 2. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (3 subgoals):
 1. \<And>a b x31 x32 x33 x34 ab bb s. \<lbrakk>fst (CSpaceAcc_A.get_cap (a, b) s) = {(ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))), s)}; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); valid_pspace s \<and> valid_mdb s \<and> valid_ioc s \<and> idle_tcb_at (\<lambda>(st, ab). idle st \<and> (case ab of (ntfn, arch) \<Rightarrow> ntfn = None \<and> valid_arch_idle arch)) (idle_thread s) s \<and> idle_thread s = idle_thread_ptr \<and> only_idle s \<and> if_unsafe_then_cap s \<and> valid_reply_caps s \<and> valid_reply_masters s \<and> valid_global_refs s \<and> valid_arch_state s \<and> valid_irq_node s \<and> valid_irq_handlers s \<and> valid_irq_states s \<and> valid_machine_state s \<and> valid_vspace_objs s \<and> valid_arch_caps s \<and> valid_global_objs s \<and> valid_kernel_mappings s \<and> equal_kernel_mappings s \<and> valid_asid_map s \<and> valid_global_vspace_mappings s \<and> pspace_in_kernel_window s \<and> cap_refs_in_kernel_window s \<and> pspace_respects_device_region s \<and> cap_refs_respects_device_region s \<and> cur_tcb s; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> idle_tcb_at (\<lambda>(st, ab). idle st \<and> (case ab of (ntfn, arch) \<Rightarrow> ntfn = None \<and> valid_arch_idle arch)) idle_thread_ptr s
 2. \<And>a b x31 x32 x33 x34 ab bb s. \<lbrakk>fst (CSpaceAcc_A.get_cap (a, b) s) = {(ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))), s)}; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> a \<noteq> idle_thread s \<and> idle_thread s = idle_thread_ptr
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (2 subgoals):
 1. \<And>a b x31 x32 x33 x34 ab bb s. \<lbrakk>fst (CSpaceAcc_A.get_cap (a, b) s) = {(ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))), s)}; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b); invs s; page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (a, b)) s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (a, b)) (pageBitsForSize x34)\<rbrakk> \<Longrightarrow> a \<noteq> idle_thread s \<and> idle_thread s = idle_thread_ptr
 2. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (2 subgoals):
 1. \<And>b x31 x32 x33 x34 ab bb s. \<lbrakk>fst (CSpaceAcc_A.get_cap (idle_thread_ptr, b) s) = {(ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))), s)}; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (idle_thread_ptr, b); page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (idle_thread_ptr, b)) s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (idle_thread_ptr, b)) (pageBitsForSize x34); valid_pspace s; valid_mdb s; valid_ioc s; idle_tcb_at (\<lambda>(st, ab). idle st \<and> (case ab of (ntfn, arch) \<Rightarrow> ntfn = None \<and> valid_arch_idle arch)) idle_thread_ptr s; idle_thread s = idle_thread_ptr; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s\<rbrakk> \<Longrightarrow> False
 2. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (3 subgoals):
 1. \<And>b x31 x32 x33 x34 ab bb s. \<lbrakk>fst (CSpaceAcc_A.get_cap (idle_thread_ptr, b) s) = {(ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))), s)}; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (idle_thread_ptr, b); page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (idle_thread_ptr, b)) s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (idle_thread_ptr, b)) (pageBitsForSize x34); valid_pspace s; valid_mdb s; valid_ioc s; idle_tcb_at (\<lambda>(st, ab). idle st \<and> (case ab of (ntfn, arch) \<Rightarrow> ntfn = None \<and> valid_arch_idle arch)) idle_thread_ptr s; idle_thread s = idle_thread_ptr; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s\<rbrakk> \<Longrightarrow> caps_of_state s (idle_thread_ptr, ?v1221 b x31 x32 x33 x34 ab bb s) = Some (?cap1221 b x31 x32 x33 x34 ab bb s)
 2. \<And>b x31 x32 x33 x34 ab bb s. \<lbrakk>fst (CSpaceAcc_A.get_cap (idle_thread_ptr, b) s) = {(ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))), s)}; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (idle_thread_ptr, b); page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (idle_thread_ptr, b)) s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (idle_thread_ptr, b)) (pageBitsForSize x34); valid_pspace s; valid_mdb s; valid_ioc s; idle_tcb_at (\<lambda>(st, ab). idle st \<and> (case ab of (ntfn, arch) \<Rightarrow> ntfn = None \<and> valid_arch_idle arch)) idle_thread_ptr s; idle_thread s = idle_thread_ptr; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; ?cap1221 b x31 x32 x33 x34 ab bb s = cap.NullCap\<rbrakk> \<Longrightarrow> False
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (3 subgoals):
 1. \<And>b x31 x32 x33 x34 ab bb s. \<lbrakk>fst (CSpaceAcc_A.get_cap (idle_thread_ptr, b) s) = {(ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))), s)}; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (idle_thread_ptr, b); page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (idle_thread_ptr, b)) s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (idle_thread_ptr, b)) (pageBitsForSize x34); valid_pspace s; valid_mdb s; valid_ioc s; idle_tcb_at (\<lambda>(st, ab). idle st \<and> (case ab of (ntfn, arch) \<Rightarrow> ntfn = None \<and> valid_arch_idle arch)) idle_thread_ptr s; idle_thread s = idle_thread_ptr; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s\<rbrakk> \<Longrightarrow> Some (?cap1221 b x31 x32 x33 x34 ab bb s) = caps_of_state s (idle_thread_ptr, ?v1221 b x31 x32 x33 x34 ab bb s)
 2. \<And>b x31 x32 x33 x34 ab bb s. \<lbrakk>fst (CSpaceAcc_A.get_cap (idle_thread_ptr, b) s) = {(ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))), s)}; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 (Some (ab, bb))); ip' = page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (idle_thread_ptr, b); page_inv_duplicates_valid (page_invocation.PageUnmap (PageCap x31 x32 x33 x34 (Some (ab, bb))) (idle_thread_ptr, b)) s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; valid_etcbs s; ct_active s; valid_unmap x34 (ab, bb); ip = cdl_page_invocation.PageUnmap (Some (transform_asid ab, bb)) x32 (transform_cslot_ptr (idle_thread_ptr, b)) (pageBitsForSize x34); valid_pspace s; valid_mdb s; valid_ioc s; idle_tcb_at (\<lambda>(st, ab). idle st \<and> (case ab of (ntfn, arch) \<Rightarrow> ntfn = None \<and> valid_arch_idle arch)) idle_thread_ptr s; idle_thread s = idle_thread_ptr; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; ?cap1221 b x31 x32 x33 x34 ab bb s = cap.NullCap\<rbrakk> \<Longrightarrow> False
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (1 subgoal):
 1. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>PageFlushCaches (flush_type_map x31) = ip; ip' = PageFlush x31 x32 x33 x34 x35 x36\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (case ip of cdl_page_invocation.PageMap frame_cap pseudo_frame_cap frame_cap_ref target_slots \<Rightarrow> do KHeap_D.set_cap frame_cap_ref frame_cap;
mapM_x (swp KHeap_D.set_cap pseudo_frame_cap) target_slots
od | cdl_page_invocation.PageUnmap mapped_addr frame_id frame_cap_ref pgsz \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> PageTableUnmap_D.unmap_page maddr frame_id pgsz;
cap <- KHeap_D.get_cap frame_cap_ref;
KHeap_D.set_cap frame_cap_ref (reset_mem_mapping cap)
od | _ \<Rightarrow> return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (1 subgoal):
 1. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31)\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (return ()) (do y <- when (x32 < x33) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
when root_switched (gets cur_thread >>= set_vm_root)
od);
return []
od) proof (prove)
goal (1 subgoal):
 1. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (return ()) (do y <- do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
if root_switched then gets cur_thread >>= set_vm_root else return ()
od;
return []
od) proof (prove)
goal (1 subgoal):
 1. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> dcorres (?r'1239 x31 x32 x33 x34 x35 x36) (\<lambda>_. True) (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) (return ()) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
if root_switched then gets cur_thread >>= set_vm_root else return ()
od) proof (prove)
goal (3 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> dcorres (?r'1239 x31 x32 x33 x34 x35 x36) (?Q1242 x31 x32 x33 x34 x35 x36) (?Q'1242 x31 x32 x33 x34 x35 x36) (return ()) (do root_switched <- set_vm_root_for_flush x35 x36;
y <- do_machine_op (do_flush x31 x32 x33 x34);
if root_switched then gets cur_thread >>= set_vm_root else return ()
od)
 2. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; True\<rbrakk> \<Longrightarrow> ?Q1242 x31 x32 x33 x34 x35 x36 s
 3. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) s\<rbrakk> \<Longrightarrow> ?Q'1242 x31 x32 x33 x34 x35 x36 s proof (prove)
goal (7 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 rv rva. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> dcorres (?r'1239 x31 x32 x33 x34 x35 x36) (?Q1242 x31 x32 x33 x34 x35 x36) (?Q'1250 x31 x32 x33 x34 x35 x36 rv rva) (return ()) (if rv then gets cur_thread >>= set_vm_root else return ())
 2. \<And>x31 x32 x33 x34 x35 x36 rv. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1246 x31 x32 x33 x34 x35 x36 rv\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>?Q'1250 x31 x32 x33 x34 x35 x36 rv\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36 rv cs. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1242 x31 x32 x33 x34 x35 x36\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>?Q'1246 x31 x32 x33 x34 x35 x36\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36 cs. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; True\<rbrakk> \<Longrightarrow> ?Q1242 x31 x32 x33 x34 x35 x36 s
 7. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) s\<rbrakk> \<Longrightarrow> ?Q'1242 x31 x32 x33 x34 x35 x36 s proof (prove)
goal (7 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 rv rva. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<not> (rv \<and> \<not> dcorres (?r'1239 x31 x32 x33 x34 x35 x36) (?Q1242 x31 x32 x33 x34 x35 x36) (?Q'1250 x31 x32 x33 x34 x35 x36 rv rva) (return ()) (gets cur_thread >>= set_vm_root) \<or> \<not> rv \<and> \<not> dcorres (?r'1239 x31 x32 x33 x34 x35 x36) (?Q1242 x31 x32 x33 x34 x35 x36) (?Q'1250 x31 x32 x33 x34 x35 x36 rv rva) (return ()) (return ()))
 2. \<And>x31 x32 x33 x34 x35 x36 rv. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1246 x31 x32 x33 x34 x35 x36 rv\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>?Q'1250 x31 x32 x33 x34 x35 x36 rv\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36 rv cs. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1242 x31 x32 x33 x34 x35 x36\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>?Q'1246 x31 x32 x33 x34 x35 x36\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36 cs. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; True\<rbrakk> \<Longrightarrow> ?Q1242 x31 x32 x33 x34 x35 x36 s
 7. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; (valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) and invs and page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) and (\<lambda>s. \<forall>x\<in>ran (kheap s). obj_valid_pdpt x) and valid_etcbs and ct_active) s\<rbrakk> \<Longrightarrow> ?Q'1242 x31 x32 x33 x34 x35 x36 s proof (prove)
goal (8 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 rv rva. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; rv; \<not> dcorres (?r'1239 x31 x32 x33 x34 x35 x36) (?Q1242 x31 x32 x33 x34 x35 x36) (?Q'1250 x31 x32 x33 x34 x35 x36 rv rva) (return ()) (gets cur_thread >>= set_vm_root)\<rbrakk> \<Longrightarrow> False
 2. \<And>x31 x32 x33 x34 x35 x36 rv rva. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; \<not> rv; \<not> dcorres (?r'1239 x31 x32 x33 x34 x35 x36) (?Q1242 x31 x32 x33 x34 x35 x36) (?Q'1250 x31 x32 x33 x34 x35 x36 rv rva) (return ()) (return ())\<rbrakk> \<Longrightarrow> False
 3. \<And>x31 x32 x33 x34 x35 x36 rv. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1246 x31 x32 x33 x34 x35 x36 rv\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>?Q'1250 x31 x32 x33 x34 x35 x36 rv\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36 rv cs. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1242 x31 x32 x33 x34 x35 x36\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>?Q'1246 x31 x32 x33 x34 x35 x36\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36 cs. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; True\<rbrakk> \<Longrightarrow> ?Q1242 x31 x32 x33 x34 x35 x36 s
 8. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; ct_active s; valid_etcbs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) s; valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) s; invs s\<rbrakk> \<Longrightarrow> ?Q'1242 x31 x32 x33 x34 x35 x36 s proof (prove)
goal (8 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 rv rva. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; rv\<rbrakk> \<Longrightarrow> dcorres (?r'1239 x31 x32 x33 x34 x35 x36) (?Q1242 x31 x32 x33 x34 x35 x36) (?Q'1250 x31 x32 x33 x34 x35 x36 rv rva) (return ()) (gets cur_thread >>= set_vm_root)
 2. \<And>x31 x32 x33 x34 x35 x36 rv rva. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; \<not> rv; \<not> dcorres (?r'1239 x31 x32 x33 x34 x35 x36) (?Q1242 x31 x32 x33 x34 x35 x36) (?Q'1250 x31 x32 x33 x34 x35 x36 rv rva) (return ()) (return ())\<rbrakk> \<Longrightarrow> False
 3. \<And>x31 x32 x33 x34 x35 x36 rv. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1246 x31 x32 x33 x34 x35 x36 rv\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>?Q'1250 x31 x32 x33 x34 x35 x36 rv\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36 rv cs. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1242 x31 x32 x33 x34 x35 x36\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>?Q'1246 x31 x32 x33 x34 x35 x36\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36 cs. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; True\<rbrakk> \<Longrightarrow> ?Q1242 x31 x32 x33 x34 x35 x36 s
 8. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; ct_active s; valid_etcbs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) s; valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) s; invs s\<rbrakk> \<Longrightarrow> ?Q'1242 x31 x32 x33 x34 x35 x36 s proof (prove)
goal (10 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 rv rva rvb. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; rv\<rbrakk> \<Longrightarrow> dcorres (?r'1239 x31 x32 x33 x34 x35 x36) (?Q1242 x31 x32 x33 x34 x35 x36) (?Q'1265 x31 x32 x33 x34 x35 x36 rv rva rvb) (return ()) (set_vm_root rvb)
 2. \<And>x31 x32 x33 x34 x35 x36 rv rva. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; rv\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1250 x31 x32 x33 x34 x35 x36 rv rva\<rbrace> gets cur_thread \<lbrace>?Q'1265 x31 x32 x33 x34 x35 x36 rv rva\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36 rv rva cs. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; rv\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> gets cur_thread \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36 rv rva. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; \<not> rv; \<not> dcorres (?r'1239 x31 x32 x33 x34 x35 x36) (?Q1242 x31 x32 x33 x34 x35 x36) (?Q'1250 x31 x32 x33 x34 x35 x36 rv rva) (return ()) (return ())\<rbrakk> \<Longrightarrow> False
 5. \<And>x31 x32 x33 x34 x35 x36 rv. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1246 x31 x32 x33 x34 x35 x36 rv\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>?Q'1250 x31 x32 x33 x34 x35 x36 rv\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36 rv cs. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1242 x31 x32 x33 x34 x35 x36\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>?Q'1246 x31 x32 x33 x34 x35 x36\<rbrace>
 8. \<And>x31 x32 x33 x34 x35 x36 cs. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 9. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; True\<rbrakk> \<Longrightarrow> ?Q1242 x31 x32 x33 x34 x35 x36 s
 10. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; ct_active s; valid_etcbs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) s; valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) s; invs s\<rbrakk> \<Longrightarrow> ?Q'1242 x31 x32 x33 x34 x35 x36 s proof (prove)
goal (9 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 rv rva. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; rv\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1250 x31 x32 x33 x34 x35 x36 rv rva\<rbrace> gets cur_thread \<lbrace>\<lambda>r _. True\<rbrace>
 2. \<And>x31 x32 x33 x34 x35 x36 rv rva cs. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; rv\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> gets cur_thread \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36 rv rva. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; \<not> rv; \<not> dcorres dc (\<lambda>_. True) (?Q'1250 x31 x32 x33 x34 x35 x36 rv rva) (return ()) (return ())\<rbrakk> \<Longrightarrow> False
 4. \<And>x31 x32 x33 x34 x35 x36 rv. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1246 x31 x32 x33 x34 x35 x36 rv\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>?Q'1250 x31 x32 x33 x34 x35 x36 rv\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36 rv cs. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1242 x31 x32 x33 x34 x35 x36\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>?Q'1246 x31 x32 x33 x34 x35 x36\<rbrace>
 7. \<And>x31 x32 x33 x34 x35 x36 cs. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 8. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; True\<rbrakk> \<Longrightarrow> True
 9. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; ct_active s; valid_etcbs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) s; valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) s; invs s\<rbrakk> \<Longrightarrow> ?Q'1242 x31 x32 x33 x34 x35 x36 s proof (prove)
goal (7 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 rv rva. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; \<not> rv; \<not> dcorres dc (\<lambda>_. True) (\<lambda>s. True) (return ()) (return ())\<rbrakk> \<Longrightarrow> False
 2. \<And>x31 x32 x33 x34 x35 x36 rv. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1246 x31 x32 x33 x34 x35 x36 rv\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>\<lambda>r s. True\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36 rv cs. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1242 x31 x32 x33 x34 x35 x36\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>?Q'1246 x31 x32 x33 x34 x35 x36\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36 cs. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; True\<rbrakk> \<Longrightarrow> True
 7. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; ct_active s; valid_etcbs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) s; valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) s; invs s\<rbrakk> \<Longrightarrow> ?Q'1242 x31 x32 x33 x34 x35 x36 s proof (prove)
goal (7 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 rv rva. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (\<lambda>s. True) (return ()) (return ())
 2. \<And>x31 x32 x33 x34 x35 x36 rv. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1246 x31 x32 x33 x34 x35 x36 rv\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>\<lambda>r s. True\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36 rv cs. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1242 x31 x32 x33 x34 x35 x36\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>?Q'1246 x31 x32 x33 x34 x35 x36\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36 cs. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; True\<rbrakk> \<Longrightarrow> True
 7. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; ct_active s; valid_etcbs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) s; valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) s; invs s\<rbrakk> \<Longrightarrow> ?Q'1242 x31 x32 x33 x34 x35 x36 s proof (prove)
goal (6 subgoals):
 1. \<And>x31 x32 x33 x34 x35 x36 rv. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1246 x31 x32 x33 x34 x35 x36 rv\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>\<lambda>r s. True\<rbrace>
 2. \<And>x31 x32 x33 x34 x35 x36 rv cs. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (do_flush x31 x32 x33 x34) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 3. \<And>x31 x32 x33 x34 x35 x36. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>?Q'1242 x31 x32 x33 x34 x35 x36\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>?Q'1246 x31 x32 x33 x34 x35 x36\<rbrace>
 4. \<And>x31 x32 x33 x34 x35 x36 cs. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> set_vm_root_for_flush x35 x36 \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; True\<rbrakk> \<Longrightarrow> True
 6. \<And>x31 x32 x33 x34 x35 x36 s. \<lbrakk>ip' = PageFlush x31 x32 x33 x34 x35 x36; ip = PageFlushCaches (flush_type_map x31); x32 < x33; ct_active s; valid_etcbs s; \<forall>x\<in>ran (kheap s). obj_valid_pdpt x; page_inv_duplicates_valid (PageFlush x31 x32 x33 x34 x35 x36) s; valid_page_inv (PageFlush x31 x32 x33 x34 x35 x36) s; invs s\<rbrakk> \<Longrightarrow> ?Q'1242 x31 x32 x33 x34 x35 x36 s proof (prove)
goal:
No subgoals!