theory Arch_DR

lemma create_mapping_entries_dcorres_select:
  assumes pdid: "pdid = pd_ptr"
      and pd_aligned: "is_aligned pd_ptr pd_bits"
      and vp_aligned: "vmsz_aligned vptr pgsz"
      and kb: "vptr < kernel_base"
  shows
  "dcorres (dc \<oplus> (\<lambda>rv rv'. rv = case_sum (\<lambda>pair. [ (transform_pt_slot_ref \<circ> hd \<circ> snd) pair])
                                 (\<lambda>pair. [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) rv'
                     \<and> case_sum (transform_pte \<circ> fst) (transform_pde \<circ> fst) rv'
                           = FrameCap False (ptrFromPAddr base)
                               vm_rights (pageBitsForSize pgsz) Fake None))
     (\<lambda>s. frslots = all_pd_pt_slots pd pdid s
              \<and> cdl_objects s pdid = Some pd)
     (page_directory_at pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned
             and (\<exists>\<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)))
     (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> Monads_D.throw)
     (create_mapping_entries base vptr pgsz vm_rights attrib pd_ptr)" proof - have lookup_pd_slot_offs_times_4_mask_2[simp]:
    "\<And>x. lookup_pd_slot pd_ptr vptr + of_nat x * 4 && mask 2 = 0" apply (subst is_aligned_mask[symmetric]) apply (rule aligned_add_aligned[where n=2], simp_all add: word_bits_conv) apply (simp add: lookup_pd_slot_def) apply (rule aligned_add_aligned[OF pd_aligned],
            simp_all add: pd_bits_def pageBits_def word_bits_conv) apply (simp_all add: is_aligned_shiftl word_shift_by_2) done have inj_on_pd:
    "inj_on (\<lambda>x. transform_pd_slot_ref (lookup_pd_slot pd_ptr vptr + toEnum x * 4)) {0 ..< 16}" apply (rule inj_onI, clarsimp simp: transform_pd_slot_ref_def) apply (drule bits_low_high_eq[rotated]) apply (simp add: mask_twice pd_bits_def pageBits_def) apply (drule(1) mask_eqI[rotated]) apply (simp add: word_shift_by_2) apply (rule ccontr, erule(3) of_nat_shift_distinct_helper) apply (simp_all add: word_bits_conv) done have map_includedI:
   "\<And>S g xs. \<lbrakk>set (map g xs) \<subseteq> S;xs \<noteq> []\<rbrakk> \<Longrightarrow> g (hd xs) \<in> S" by (clarsimp simp:hd_map_simp neq_Nil_conv) show ?thesis using pdid vp_aligned apply clarsimp proof (induct pgsz) case ARMSmallPage show ?case using ARMSmallPage.prems apply (simp add: liftME_def[symmetric] o_def transform_pte_def
                                     lookup_error_injection dc_def[symmetric]) apply (rule dcorres_injection_handler_rhs) apply (simp add: lookup_pt_slot_def liftE_bindE) apply (rule corres_symb_exec_r[OF _ get_pde_sp get_pde_inv], simp_all)[1] apply (clarsimp simp add: corres_alternate2 split: ARM_A.pde.split) apply (rule corres_alternate1) apply (rule corres_from_rdonly, simp_all)[1] apply (wp | simp)+ apply (simp add: returnOk_def in_monad select_def, wp) apply (clarsimp simp: transform_pt_slot_ref_def all_pd_pt_slots_def
                              opt_object_page_directory
                              obj_at_def object_slots_def transform_page_directory_contents_def
                              unat_map_def kernel_pde_mask_def lookup_pd_slot_pd
                              pd_aligned
                       dest!: a_type_pdD
                         del: disjCI) apply (drule valid_vspace_objsD, simp add: obj_at_def, simp+) apply (cut_tac less_kernel_base_mapping_slots[OF kb pd_aligned]) apply (drule_tac x="ucast (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)" in bspec) apply simp apply (drule_tac t="pda v" for v in sym, simp) apply (clarsimp simp: obj_at_def del: disjCI) apply (frule_tac p="ptrFromPAddr v" for v in pspace_alignedD, simp+) apply (rule disjI2, rule conjI) apply (rule_tac x="unat (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)"
                    in exI) apply (simp add: transform_pde_def ucast_nat_def) apply (subst is_aligned_add_helper, simp add: pt_bits_def pageBits_def) apply (rule shiftl_less_t2n) apply (rule order_le_less_trans, rule word_and_le1, simp add: pt_bits_def pageBits_def) apply (simp add: pt_bits_def pageBits_def) apply simp apply (simp add: kernel_mapping_slots_def) apply (subst is_aligned_add_helper, simp add: pt_bits_def pageBits_def) apply (rule shiftl_less_t2n) apply (rule order_le_less_trans, rule word_and_le1, simp add: pt_bits_def pageBits_def) apply (simp add: pt_bits_def pageBits_def) apply (simp add: dom_def transform_def transform_objects_def
                         restrict_map_def map_add_def) apply (clarsimp simp: valid_idle_def pred_tcb_at_def obj_at_def) done next case ARMLargePage show ?case using ARMLargePage.prems apply (simp add: liftME_def[symmetric] o_def transform_pte_def largePagePTE_offsets_def
                                     lookup_error_injection dc_def[symmetric]) apply (rule dcorres_injection_handler_rhs) apply (simp add: lookup_pt_slot_def liftE_bindE) apply (rule corres_symb_exec_r[OF _ get_pde_sp get_pde_inv], simp_all)[1] apply (clarsimp simp add: corres_alternate2 split: ARM_A.pde.split) apply (rename_tac word1 set word2) apply (rule corres_alternate1) apply (rule corres_from_rdonly, simp_all)[1] apply (wp | simp)+ apply (simp add: returnOk_def in_monad select_def, wp) apply (clarsimp simp: pd_aligned obj_at_def lookup_pd_slot_pd
                              a_type_simps) apply (drule valid_vspace_objsD, simp add: obj_at_def, simp+) apply (cut_tac less_kernel_base_mapping_slots[OF kb pd_aligned]) apply (drule_tac x="ucast (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)" in bspec) apply simp apply (drule_tac t="pda v" for v in sym, simp) apply (clarsimp simp: obj_at_def del: disjCI) apply (frule_tac p="ptrFromPAddr v" for v in pspace_alignedD, simp+) apply (rule map_includedI) apply (clarsimp simp: transform_pt_slot_ref_def all_pd_pt_slots_def
                               opt_object_page_directory
                               object_slots_def transform_page_directory_contents_def
                               unat_map_def kernel_pde_mask_def
                          del: disjCI UnCI) apply (subgoal_tac "x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits = ptrFromPAddr word1") apply (rule disjI2, rule conjI) apply (rule_tac x="unat (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)"
                      in exI) apply (simp add: transform_pde_def ucast_nat_def) apply (simp add: kernel_mapping_slots_def) apply (simp add: dom_def transform_def transform_objects_def
                           restrict_map_def) apply (clarsimp simp: valid_idle_def pred_tcb_at_def obj_at_def) apply (clarsimp simp: upto_enum_step_def pt_bits_def pageBits_def
                        split: if_split_asm) apply (subst add.commute, subst add.assoc, subst is_aligned_add_helper, assumption) apply (simp only: word_shift_by_2 word_shiftl_add_distrib[symmetric]) apply (rule shiftl_less_t2n) apply (rule is_aligned_add_less_t2n[where n=4]) apply (rule is_aligned_andI1) apply (rule is_aligned_shiftr) apply (simp add: vmsz_aligned_def) apply (simp add: word_leq_minus_one_le) apply simp apply (rule order_le_less_trans, rule word_and_le1, simp) apply simp apply simp apply (simp add: upto_enum_step_def not_less upto_enum_def) done next case ARMSection show ?case using ARMSection.prems apply (simp add: liftME_def[symmetric] o_def transform_pte_def
                                     lookup_error_injection dc_def[symmetric]) apply (rule corres_alternate1) apply (rule corres_from_rdonly, simp_all)[1] apply (wp | simp)+ apply (simp add: returnOk_def in_monad select_def, wp) apply (clarsimp simp: transform_pde_def obj_at_def
                              opt_object_page_directory
                       dest!: a_type_pdD) apply (simp add: transform_pd_slot_ref_def lookup_pd_slot_def
                         all_pd_pt_slots_def object_slots_def
                         transform_page_directory_contents_def
                         dom_def unat_map_def) done next case ARMSuperSection show ?case using ARMSuperSection.prems using pd_aligned apply (simp add: liftME_def[symmetric] o_def transform_pte_def
                                     lookup_error_injection dc_def[symmetric]) apply (rule corres_alternate1) apply (rule corres_from_rdonly, simp_all)[1] apply (wp | simp)+ apply (simp add: returnOk_def in_monad select_def, wp) apply (clarsimp simp: transform_pde_def obj_at_def
                              opt_object_page_directory
                       dest!: a_type_pdD) apply (rule map_includedI) apply clarsimp apply (clarsimp simp: all_pd_pt_slots_def transform_pd_slot_ref_def
                               object_slots_def transform_page_directory_contents_def
                               dom_def unat_map_def) apply (simp add: not_less upto_enum_step_def upto_enum_def superSectionPDE_offsets_def) done qed qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize pgsz) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pdid s \<and> cdl_objects s pdid = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr pgsz vm_rights attrib pd_ptr) proof (state)
goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize pgsz) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pdid s \<and> cdl_objects s pdid = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr pgsz vm_rights attrib pd_ptr) proof (prove)
goal (1 subgoal):
 1. \<And>x. lookup_pd_slot pd_ptr vptr + word_of_nat x * 4 && mask 2 = 0 proof (prove)
goal (1 subgoal):
 1. \<And>x. is_aligned (lookup_pd_slot pd_ptr vptr + word_of_nat x * 4) 2 proof (prove)
goal (2 subgoals):
 1. is_aligned (lookup_pd_slot pd_ptr vptr) 2
 2. \<And>x. is_aligned (word_of_nat x * 4) 2 proof (prove)
goal (2 subgoals):
 1. is_aligned (pd_ptr + (vptr >> 20 << 2)) 2
 2. \<And>x. is_aligned (word_of_nat x * 4) 2 proof (prove)
goal (2 subgoals):
 1. is_aligned (vptr >> 20 << 2) 2
 2. \<And>x. is_aligned (word_of_nat x * 4) 2 proof (prove)
goal:
No subgoals! proof (state)
this:
lookup_pd_slot pd_ptr vptr + word_of_nat ?x * 4 && mask 2 = 0

goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize pgsz) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pdid s \<and> cdl_objects s pdid = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr pgsz vm_rights attrib pd_ptr) proof (prove)
goal (1 subgoal):
 1. inj_on (\<lambda>x. transform_pd_slot_ref (lookup_pd_slot pd_ptr vptr + toEnum x * 4)) {0..<16} proof (prove)
goal (1 subgoal):
 1. \<And>x y. \<lbrakk>x < 16; y < 16; lookup_pd_slot pd_ptr vptr + word_of_nat x * 4 && ~~ mask pd_bits = lookup_pd_slot pd_ptr vptr + word_of_nat y * 4 && ~~ mask pd_bits; lookup_pd_slot pd_ptr vptr + word_of_nat x * 4 && mask pd_bits >> 2 = lookup_pd_slot pd_ptr vptr + word_of_nat y * 4 && mask pd_bits >> 2\<rbrakk> \<Longrightarrow> x = y proof (prove)
goal (2 subgoals):
 1. \<And>x y. \<lbrakk>x < 16; y < 16; lookup_pd_slot pd_ptr vptr + word_of_nat x * 4 && ~~ mask pd_bits = lookup_pd_slot pd_ptr vptr + word_of_nat y * 4 && ~~ mask pd_bits\<rbrakk> \<Longrightarrow> (lookup_pd_slot pd_ptr vptr + word_of_nat x * 4 && mask pd_bits) && mask 2 = (lookup_pd_slot pd_ptr vptr + word_of_nat y * 4 && mask pd_bits) && mask 2
 2. \<And>x y. \<lbrakk>x < 16; y < 16; lookup_pd_slot pd_ptr vptr + word_of_nat x * 4 && ~~ mask pd_bits = lookup_pd_slot pd_ptr vptr + word_of_nat y * 4 && ~~ mask pd_bits; lookup_pd_slot pd_ptr vptr + word_of_nat x * 4 && mask pd_bits = lookup_pd_slot pd_ptr vptr + word_of_nat y * 4 && mask pd_bits\<rbrakk> \<Longrightarrow> x = y proof (prove)
goal (1 subgoal):
 1. \<And>x y. \<lbrakk>x < 16; y < 16; lookup_pd_slot pd_ptr vptr + word_of_nat x * 4 && ~~ mask pd_bits = lookup_pd_slot pd_ptr vptr + word_of_nat y * 4 && ~~ mask pd_bits; lookup_pd_slot pd_ptr vptr + word_of_nat x * 4 && mask pd_bits = lookup_pd_slot pd_ptr vptr + word_of_nat y * 4 && mask pd_bits\<rbrakk> \<Longrightarrow> x = y proof (prove)
goal (1 subgoal):
 1. \<And>x y. \<lbrakk>x < 16; y < 16; lookup_pd_slot pd_ptr vptr + word_of_nat x * 4 && mask pd_bits = lookup_pd_slot pd_ptr vptr + word_of_nat y * 4 && mask pd_bits; lookup_pd_slot pd_ptr vptr + word_of_nat x * 4 = lookup_pd_slot pd_ptr vptr + word_of_nat y * 4\<rbrakk> \<Longrightarrow> x = y proof (prove)
goal (1 subgoal):
 1. \<And>x y. \<lbrakk>x < 16; y < 16; word_of_nat x << 2 = word_of_nat y << 2\<rbrakk> \<Longrightarrow> x = y proof (prove)
goal (2 subgoals):
 1. \<And>x y. \<lbrakk>y < 16; word_of_nat x << 2 = word_of_nat y << 2; x \<noteq> y\<rbrakk> \<Longrightarrow> 2 < LENGTH(32)
 2. \<And>x y. \<lbrakk>y < 16; word_of_nat x << 2 = word_of_nat y << 2; x \<noteq> y\<rbrakk> \<Longrightarrow> 16 \<le> 2 ^ (LENGTH(32) - 2) proof (prove)
goal:
No subgoals! proof (state)
this:
inj_on (\<lambda>x. transform_pd_slot_ref (lookup_pd_slot pd_ptr vptr + toEnum x * 4)) {0..<16}

goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize pgsz) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pdid s \<and> cdl_objects s pdid = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr pgsz vm_rights attrib pd_ptr) proof (prove)
goal (1 subgoal):
 1. \<And>S g xs. \<lbrakk>set (map g xs) \<subseteq> S; xs \<noteq> []\<rbrakk> \<Longrightarrow> g (hd xs) \<in> S proof (state)
this:
\<lbrakk>set (map ?g ?xs) \<subseteq> ?S; ?xs \<noteq> []\<rbrakk> \<Longrightarrow> ?g (hd ?xs) \<in> ?S

goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize pgsz) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pdid s \<and> cdl_objects s pdid = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr pgsz vm_rights attrib pd_ptr) proof (prove)
goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize pgsz) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pdid s \<and> cdl_objects s pdid = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr pgsz vm_rights attrib pd_ptr) proof (prove)
using this:
pdid = pd_ptr
vmsz_aligned vptr pgsz

goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize pgsz) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pdid s \<and> cdl_objects s pdid = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr pgsz vm_rights attrib pd_ptr) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr pgsz\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize pgsz) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr pgsz vm_rights attrib pd_ptr) proof (state)
goal (4 subgoals):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSmallPage) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSmallPage vm_rights attrib pd_ptr)
 2. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMLargePage) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMLargePage vm_rights attrib pd_ptr)
 3. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSection vm_rights attrib pd_ptr)
 4. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSuperSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSuperSection vm_rights attrib pd_ptr) proof (state)
this:
pdid = pd_ptr
vmsz_aligned vptr ARMSmallPage

goal (4 subgoals):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSmallPage) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSmallPage vm_rights attrib pd_ptr)
 2. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMLargePage) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMLargePage vm_rights attrib pd_ptr)
 3. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSection vm_rights attrib pd_ptr)
 4. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSuperSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSuperSection vm_rights attrib pd_ptr) proof (prove)
goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSmallPage) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSmallPage vm_rights attrib pd_ptr) proof (prove)
using this:
pdid = pd_ptr
vmsz_aligned vptr ARMSmallPage

goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSmallPage) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSmallPage vm_rights attrib pd_ptr) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x xa. x = [transform_pt_slot_ref xa])) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (\<lambda>a. typ_at (AArch APageDirectory) pd_ptr a \<and> valid_idle a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) a)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (injection_handler (FailedLookup False) (lookup_pt_slot pd_ptr vptr)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x xa. x = [transform_pt_slot_ref xa])) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (\<lambda>a. typ_at (AArch APageDirectory) pd_ptr a \<and> valid_idle a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) a)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (lookup_pt_slot pd_ptr vptr) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x xa. x = [transform_pt_slot_ref xa])) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (\<lambda>a. typ_at (AArch APageDirectory) pd_ptr a \<and> valid_idle a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) a)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (get_pde (lookup_pd_slot pd_ptr vptr) >>= case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vptr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20))) proof (prove)
goal (1 subgoal):
 1. \<And>rv. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x xa. x = [transform_pt_slot_ref xa])) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (\<lambda>s. \<exists>pd. ako_at (arch_kernel_obj.PageDirectory pd) (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits) s \<and> rv = pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) \<and> typ_at (AArch APageDirectory) pd_ptr s \<and> valid_idle s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (case rv of PageTablePDE ptab x xa \<Rightarrow> returnOk (ptrFromPAddr ptab + ((vptr >> 12) && 0xFF << 2)) | _ \<Rightarrow> throwError (MissingCapability 20)) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x22 x23. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x xa. x = [transform_pt_slot_ref xa])) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (\<lambda>s. \<exists>pd. ako_at (arch_kernel_obj.PageDirectory pd) (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits) s \<and> PageTablePDE x21 x22 x23 = pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) \<and> typ_at (AArch APageDirectory) pd_ptr s \<and> valid_idle s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (returnOk (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2))) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x22 x23. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x xa. x = [transform_pt_slot_ref xa])) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (\<lambda>s. \<exists>pd. ako_at (arch_kernel_obj.PageDirectory pd) (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits) s \<and> PageTablePDE x21 x22 x23 = pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) \<and> typ_at (AArch APageDirectory) pd_ptr s \<and> valid_idle s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M})) (returnOk (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2))) proof (prove)
goal (3 subgoals):
 1. \<And>P. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>x21 P. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> returnOk (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2)) \<lbrace>\<lambda>rv. P\<rbrace>
 3. \<And>x21 x22 x23 s s'. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd; \<exists>pd. ako_at (arch_kernel_obj.PageDirectory pd) (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits) s' \<and> PageTablePDE x21 x22 x23 = pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) \<and> typ_at (AArch APageDirectory) pd_ptr s' \<and> valid_idle s' \<and> valid_vspace_objs s' \<and> pspace_aligned s' \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s'); transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> returnOk (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2)) \<lbrace>\<lambda>rv s''. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst (liftE (select {M. set M \<subseteq> all_pd_pt_slots pd pd_ptr s \<and> distinct M}) s)) \<and> (dc \<oplus> (\<lambda>x xa. x = [transform_pt_slot_ref xa])) rv' rv\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x21 x22 x23 s s'. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd; \<exists>pd. ako_at (arch_kernel_obj.PageDirectory pd) (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits) s' \<and> PageTablePDE x21 x22 x23 = pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) \<and> typ_at (AArch APageDirectory) pd_ptr s' \<and> valid_idle s' \<and> valid_vspace_objs s' \<and> pspace_aligned s' \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s'); transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> returnOk (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2)) \<lbrace>\<lambda>rv s''. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst (liftE (select {M. set M \<subseteq> all_pd_pt_slots pd pd_ptr s \<and> distinct M}) s)) \<and> (dc \<oplus> (\<lambda>x xa. x = [transform_pt_slot_ref xa])) rv' rv\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>x21 x22 x23 s s' sa. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd; \<exists>pd. ako_at (arch_kernel_obj.PageDirectory pd) (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits) s' \<and> PageTablePDE x21 x22 x23 = pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) \<and> typ_at (AArch APageDirectory) pd_ptr s' \<and> valid_idle s' \<and> valid_vspace_objs s' \<and> pspace_aligned s' \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s'); transform s' = s; s' = sa\<rbrakk> \<Longrightarrow> \<exists>rv'. (\<exists>v'. rv' = Inr v' \<and> set v' \<subseteq> all_pd_pt_slots pd pd_ptr s \<and> distinct v') \<and> (dc \<oplus> (\<lambda>x xa. x = [transform_pt_slot_ref xa])) rv' (Inr (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2))) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x22 x23 sa pda ref. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; PageTablePDE x21 x22 x23 = pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)); valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; (ref \<rhd> pd_ptr) sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>\<rbrakk> \<Longrightarrow> unat (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && mask pt_bits >> 2) \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))) \<or> (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits) b c)) \<and> a < 4096) \<and> (\<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits) b c)) \<and> a < 4096)) \<and> ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa)) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x22 x23 sa pda. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; PageTablePDE x21 x22 x23 = pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)); valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; \<forall>x\<in>- kernel_mapping_slots. valid_pde (pda x) sa\<rbrakk> \<Longrightarrow> unat (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && mask pt_bits >> 2) \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))) \<or> (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits) b c)) \<and> a < 4096) \<and> (\<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits) b c)) \<and> a < 4096)) \<and> ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa)) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x22 x23 sa pda. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; PageTablePDE x21 x22 x23 = pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)); valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; \<forall>x\<in>- kernel_mapping_slots. valid_pde (pda x) sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> unat (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && mask pt_bits >> 2) \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))) \<or> (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits) b c)) \<and> a < 4096) \<and> (\<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits) b c)) \<and> a < 4096)) \<and> ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa)) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x22 x23 sa pda. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; PageTablePDE x21 x22 x23 = pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)); valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<in> - kernel_mapping_slots
 2. \<And>x21 x22 x23 sa pda. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; PageTablePDE x21 x22 x23 = pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)); valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; valid_pde (pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2))) sa\<rbrakk> \<Longrightarrow> unat (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && mask pt_bits >> 2) \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))) \<or> (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits) b c)) \<and> a < 4096) \<and> (\<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits) b c)) \<and> a < 4096)) \<and> ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa)) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x22 x23 sa pda. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; PageTablePDE x21 x22 x23 = pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)); valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; valid_pde (pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2))) sa\<rbrakk> \<Longrightarrow> unat (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && mask pt_bits >> 2) \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))) \<or> (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits) b c)) \<and> a < 4096) \<and> (\<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits) b c)) \<and> a < 4096)) \<and> ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa)) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x22 x23 sa pda. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; typ_at (AArch APageTable) (ptrFromPAddr x21) sa; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> unat (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && mask pt_bits >> 2) \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))) \<or> (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits) b c)) \<and> a < 4096) \<and> (\<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits) b c)) \<and> a < 4096)) \<and> ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa)) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt))\<rbrakk> \<Longrightarrow> unat (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && mask pt_bits >> 2) \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))) \<or> (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits) b c)) \<and> a < 4096) \<and> (\<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits) b c)) \<and> a < 4096)) \<and> ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa)) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> unat (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && mask pt_bits >> 2) \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))) \<or> (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits) b c)) \<and> a < 4096) \<and> (\<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits) b c)) \<and> a < 4096)) \<and> ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa)) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> \<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits) b c)) \<and> a < 4096) \<and> (\<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits) b c)) \<and> a < 4096)
 2. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa)) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat (unat (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) \<longrightarrow> (unat (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits) b c)) \<and> unat (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) < 4096) \<and> (\<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat (unat (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) \<longrightarrow> (unat (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat (unat (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)))) = cdl_cap.PageTableCap (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits) b c)) \<and> unat (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) < 4096)
 2. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa)) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> \<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<and> (\<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<longrightarrow> ptrFromPAddr x21 = ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits)
 2. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa)) proof (prove)
goal (3 subgoals):
 1. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> (vptr >> 12) && 0xFF << 2 < 2 ^ pt_bits
 2. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> \<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<and> (\<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<longrightarrow> ptrFromPAddr x21 = ptrFromPAddr x21)
 3. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa)) proof (prove)
goal (4 subgoals):
 1. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> (vptr >> 12) && 0xFF < 2 ^ (pt_bits - 2)
 2. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> pt_bits < LENGTH(32)
 3. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> \<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<and> (\<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<longrightarrow> ptrFromPAddr x21 = ptrFromPAddr x21)
 4. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa)) proof (prove)
goal (3 subgoals):
 1. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> pt_bits < LENGTH(32)
 2. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> \<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<and> (\<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<longrightarrow> ptrFromPAddr x21 = ptrFromPAddr x21)
 3. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa)) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> \<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<and> (\<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<longrightarrow> ptrFromPAddr x21 = ptrFromPAddr x21)
 2. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa)) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> \<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)
 2. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa)) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa)) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> (vptr >> 12) && 0xFF << 2 < 2 ^ pt_bits
 2. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> ptrFromPAddr x21 \<in> dom (cdl_objects (transform sa)) proof (prove)
goal (3 subgoals):
 1. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> (vptr >> 12) && 0xFF < 2 ^ (pt_bits - 2)
 2. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> pt_bits < LENGTH(32)
 3. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> ptrFromPAddr x21 \<in> dom (cdl_objects (transform sa)) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> pt_bits < LENGTH(32)
 2. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> ptrFromPAddr x21 \<in> dom (cdl_objects (transform sa)) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> ptrFromPAddr x21 \<in> dom (cdl_objects (transform sa)) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x22 x23 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSmallPage; frslots = {(pd_id, y). \<exists>ya. unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) y = Some ya} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> (\<exists>y. (case if x \<noteq> idle_thread sa then kheap sa x else None of None \<Rightarrow> if x \<noteq> idle_thread sa then Some cdl_object.Untyped else None | Some xa \<Rightarrow> (Some \<circ> transform_object (machine_state sa) x (if x \<noteq> idle_thread sa then ekheap sa x else None)) xa) = Some y)}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap sa (ptrFromPAddr x21) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr x21) 10\<rbrakk> \<Longrightarrow> ptrFromPAddr x21 \<noteq> idle_thread sa proof (prove)
goal:
No subgoals! proof (state)
this:
dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSmallPage) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSmallPage vm_rights attrib pd_ptr)

goal (3 subgoals):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMLargePage) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMLargePage vm_rights attrib pd_ptr)
 2. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSection vm_rights attrib pd_ptr)
 3. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSuperSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSuperSection vm_rights attrib pd_ptr) proof (state)
goal (3 subgoals):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMLargePage) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMLargePage vm_rights attrib pd_ptr)
 2. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSection vm_rights attrib pd_ptr)
 3. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSuperSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSuperSection vm_rights attrib pd_ptr) proof (state)
this:
pdid = pd_ptr
vmsz_aligned vptr ARMLargePage

goal (3 subgoals):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMLargePage) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMLargePage vm_rights attrib pd_ptr)
 2. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSection vm_rights attrib pd_ptr)
 3. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSuperSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSuperSection vm_rights attrib pd_ptr) proof (prove)
goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMLargePage) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMLargePage vm_rights attrib pd_ptr) proof (prove)
using this:
pdid = pd_ptr
vmsz_aligned vptr ARMLargePage

goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMLargePage) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMLargePage vm_rights attrib pd_ptr) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x xa. x = [transform_pt_slot_ref (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))])) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (\<lambda>a. typ_at (AArch APageDirectory) pd_ptr a \<and> valid_idle a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) a)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (injection_handler (FailedLookup False) (lookup_pt_slot pd_ptr vptr)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x xa. x = [transform_pt_slot_ref (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))])) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (\<lambda>a. typ_at (AArch APageDirectory) pd_ptr a \<and> valid_idle a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) a)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (lookup_pt_slot pd_ptr vptr) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x xa. x = [transform_pt_slot_ref (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))])) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (\<lambda>a. typ_at (AArch APageDirectory) pd_ptr a \<and> valid_idle a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) a)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (get_pde (lookup_pd_slot pd_ptr vptr) >>= case_pde (throwError (MissingCapability 20)) (\<lambda>ptab x xa. returnOk (ptrFromPAddr ptab + ((vptr >> 12) && 0xFF << 2))) (\<lambda>word1 set1 word2 set2. throwError (MissingCapability 20)) (\<lambda>word set1 set2. throwError (MissingCapability 20))) proof (prove)
goal (1 subgoal):
 1. \<And>rv. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x xa. x = [transform_pt_slot_ref (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))])) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (\<lambda>s. \<exists>pd. ako_at (arch_kernel_obj.PageDirectory pd) (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits) s \<and> rv = pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) \<and> typ_at (AArch APageDirectory) pd_ptr s \<and> valid_idle s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (case rv of PageTablePDE ptab x xa \<Rightarrow> returnOk (ptrFromPAddr ptab + ((vptr >> 12) && 0xFF << 2)) | _ \<Rightarrow> throwError (MissingCapability 20)) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x22 x23. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x xa. x = [transform_pt_slot_ref (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))])) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (\<lambda>s. \<exists>pd. ako_at (arch_kernel_obj.PageDirectory pd) (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits) s \<and> PageTablePDE x21 x22 x23 = pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) \<and> typ_at (AArch APageDirectory) pd_ptr s \<and> valid_idle s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (returnOk (ptrFromPAddr x21 + ((vptr >> 12) && 0xFF << 2))) proof (prove)
goal (1 subgoal):
 1. \<And>word1 seta word2. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x xa. x = [transform_pt_slot_ref (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))])) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (\<lambda>s. \<exists>pd. ako_at (arch_kernel_obj.PageDirectory pd) (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits) s \<and> PageTablePDE word1 seta word2 = pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) \<and> typ_at (AArch APageDirectory) pd_ptr s \<and> valid_idle s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (returnOk (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) proof (prove)
goal (1 subgoal):
 1. \<And>word1 seta word2. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x xa. x = [transform_pt_slot_ref (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))])) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (\<lambda>s. \<exists>pd. ako_at (arch_kernel_obj.PageDirectory pd) (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits) s \<and> PageTablePDE word1 seta word2 = pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) \<and> typ_at (AArch APageDirectory) pd_ptr s \<and> valid_idle s \<and> valid_vspace_objs s \<and> pspace_aligned s \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M})) (returnOk (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) proof (prove)
goal (3 subgoals):
 1. \<And>P. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>word1 P. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> returnOk (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) \<lbrace>\<lambda>rv. P\<rbrace>
 3. \<And>word1 seta word2 s s'. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd; \<exists>pd. ako_at (arch_kernel_obj.PageDirectory pd) (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits) s' \<and> PageTablePDE word1 seta word2 = pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) \<and> typ_at (AArch APageDirectory) pd_ptr s' \<and> valid_idle s' \<and> valid_vspace_objs s' \<and> pspace_aligned s' \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s'); transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> returnOk (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) \<lbrace>\<lambda>rv s''. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst (liftE (select {M. set M \<subseteq> all_pd_pt_slots pd pd_ptr s \<and> distinct M}) s)) \<and> (dc \<oplus> (\<lambda>x xa. x = [transform_pt_slot_ref (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))])) rv' rv\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>word1 seta word2 s s'. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd; \<exists>pd. ako_at (arch_kernel_obj.PageDirectory pd) (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits) s' \<and> PageTablePDE word1 seta word2 = pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) \<and> typ_at (AArch APageDirectory) pd_ptr s' \<and> valid_idle s' \<and> valid_vspace_objs s' \<and> pspace_aligned s' \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s'); transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> returnOk (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) \<lbrace>\<lambda>rv s''. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst (liftE (select {M. set M \<subseteq> all_pd_pt_slots pd pd_ptr s \<and> distinct M}) s)) \<and> (dc \<oplus> (\<lambda>x xa. x = [transform_pt_slot_ref (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))])) rv' rv\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>word1 seta word2 s s' sa. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd; \<exists>pd. ako_at (arch_kernel_obj.PageDirectory pd) (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits) s' \<and> PageTablePDE word1 seta word2 = pd (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) \<and> typ_at (AArch APageDirectory) pd_ptr s' \<and> valid_idle s' \<and> valid_vspace_objs s' \<and> pspace_aligned s' \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s'); transform s' = s; s' = sa\<rbrakk> \<Longrightarrow> \<exists>rv'. (\<exists>v'. rv' = Inr v' \<and> set v' \<subseteq> all_pd_pt_slots pd pd_ptr s \<and> distinct v') \<and> (dc \<oplus> (\<lambda>x xa. x = [transform_pt_slot_ref (hd (map (\<lambda>x. x + xa) [0 , 4 .e. 0x3C]))])) rv' (Inr (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) proof (prove)
goal (1 subgoal):
 1. \<And>word1 set word2 sa pda ref. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; PageTablePDE word1 set word2 = pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)); valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; (ref \<rhd> pd_ptr) sa\<rbrakk> \<Longrightarrow> transform_pt_slot_ref (hd (map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C])) \<in> all_pd_pt_slots pd pd_ptr (transform sa) proof (prove)
goal (1 subgoal):
 1. \<And>word1 set word2 sa pda. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; PageTablePDE word1 set word2 = pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)); valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; \<forall>x\<in>- kernel_mapping_slots. valid_pde (pda x) sa\<rbrakk> \<Longrightarrow> transform_pt_slot_ref (hd (map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C])) \<in> all_pd_pt_slots pd pd_ptr (transform sa) proof (prove)
goal (1 subgoal):
 1. \<And>word1 set word2 sa pda. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; PageTablePDE word1 set word2 = pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)); valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; \<forall>x\<in>- kernel_mapping_slots. valid_pde (pda x) sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> transform_pt_slot_ref (hd (map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C])) \<in> all_pd_pt_slots pd pd_ptr (transform sa) proof (prove)
goal (2 subgoals):
 1. \<And>word1 set word2 sa pda. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; PageTablePDE word1 set word2 = pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)); valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<in> - kernel_mapping_slots
 2. \<And>word1 set word2 sa pda. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; PageTablePDE word1 set word2 = pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)); valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; valid_pde (pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2))) sa\<rbrakk> \<Longrightarrow> transform_pt_slot_ref (hd (map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C])) \<in> all_pd_pt_slots pd pd_ptr (transform sa) proof (prove)
goal (1 subgoal):
 1. \<And>word1 set word2 sa pda. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; PageTablePDE word1 set word2 = pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)); valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; valid_pde (pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2))) sa\<rbrakk> \<Longrightarrow> transform_pt_slot_ref (hd (map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C])) \<in> all_pd_pt_slots pd pd_ptr (transform sa) proof (prove)
goal (1 subgoal):
 1. \<And>word1 set word2 sa pda. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; typ_at (AArch APageTable) (ptrFromPAddr word1) sa; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2\<rbrakk> \<Longrightarrow> transform_pt_slot_ref (hd (map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C])) \<in> all_pd_pt_slots pd pd_ptr (transform sa) proof (prove)
goal (1 subgoal):
 1. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt))\<rbrakk> \<Longrightarrow> transform_pt_slot_ref (hd (map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C])) \<in> all_pd_pt_slots pd pd_ptr (transform sa) proof (prove)
goal (1 subgoal):
 1. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> transform_pt_slot_ref (hd (map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C])) \<in> all_pd_pt_slots pd pd_ptr (transform sa) proof (prove)
goal (2 subgoals):
 1. \<And>word1 seta word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 seta word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> set (map transform_pt_slot_ref (map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C])) \<subseteq> all_pd_pt_slots pd pd_ptr (transform sa)
 2. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal (2 subgoals):
 1. \<And>word1 seta word2 sa pda pt x. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 seta word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; x \<in> set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> unat (x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && mask pt_bits >> 2) \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))) \<or> (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap (x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits) b c)) \<and> a < 4096) \<and> (\<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap (x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits) b c)) \<and> a < 4096)) \<and> x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa))
 2. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal (3 subgoals):
 1. \<And>word1 seta word2 sa pda pt x. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 seta word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; x \<in> set [0 , 4 .e. 0x3C]; x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits = ptrFromPAddr word1\<rbrakk> \<Longrightarrow> unat (x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && mask pt_bits >> 2) \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))) \<or> (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap (x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits) b c)) \<and> a < 4096) \<and> (\<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap (x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits) b c)) \<and> a < 4096)) \<and> x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa))
 2. \<And>word1 seta word2 sa pda pt x. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 seta word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; x \<in> set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits = ptrFromPAddr word1
 3. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal (4 subgoals):
 1. \<And>word1 seta word2 sa pda pt x. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 seta word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; x \<in> set [0 , 4 .e. 0x3C]; x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits = ptrFromPAddr word1\<rbrakk> \<Longrightarrow> \<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap (x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits) b c)) \<and> a < 4096) \<and> (\<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap (x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits) b c)) \<and> a < 4096)
 2. \<And>word1 seta word2 sa pda pt x. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 seta word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; x \<in> set [0 , 4 .e. 0x3C]; x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits = ptrFromPAddr word1\<rbrakk> \<Longrightarrow> x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa))
 3. \<And>word1 seta word2 sa pda pt x. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 seta word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; x \<in> set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits = ptrFromPAddr word1
 4. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal (4 subgoals):
 1. \<And>word1 seta word2 sa pda pt x. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 seta word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; x \<in> set [0 , 4 .e. 0x3C]; x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits = ptrFromPAddr word1\<rbrakk> \<Longrightarrow> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat (unat (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) \<longrightarrow> (unat (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap (x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits) b c)) \<and> unat (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) < 4096) \<and> (\<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat (unat (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) \<longrightarrow> (unat (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat (unat (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)))) = cdl_cap.PageTableCap (x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits) b c)) \<and> unat (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) < 4096)
 2. \<And>word1 seta word2 sa pda pt x. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 seta word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; x \<in> set [0 , 4 .e. 0x3C]; x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits = ptrFromPAddr word1\<rbrakk> \<Longrightarrow> x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa))
 3. \<And>word1 seta word2 sa pda pt x. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 seta word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; x \<in> set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits = ptrFromPAddr word1
 4. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal (4 subgoals):
 1. \<And>word1 seta word2 sa pda pt x. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 seta word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; x \<in> set [0 , 4 .e. 0x3C]; x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits = ptrFromPAddr word1\<rbrakk> \<Longrightarrow> \<not> UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)
 2. \<And>word1 seta word2 sa pda pt x. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 seta word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; x \<in> set [0 , 4 .e. 0x3C]; x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits = ptrFromPAddr word1\<rbrakk> \<Longrightarrow> x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa))
 3. \<And>word1 seta word2 sa pda pt x. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 seta word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; x \<in> set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits = ptrFromPAddr word1
 4. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal (3 subgoals):
 1. \<And>word1 seta word2 sa pda pt x. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 seta word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; x \<in> set [0 , 4 .e. 0x3C]; x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits = ptrFromPAddr word1\<rbrakk> \<Longrightarrow> x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits \<in> dom (cdl_objects (transform sa))
 2. \<And>word1 seta word2 sa pda pt x. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 seta word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; x \<in> set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits = ptrFromPAddr word1
 3. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal (3 subgoals):
 1. \<And>word1 seta word2 sa pda pt x. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = {(pd_id, y). \<exists>ya. unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) y = Some ya} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> ((\<exists>y. (if x \<noteq> idle_thread sa then kheap sa x else None) = Some y) \<or> (\<exists>y. (if x \<noteq> idle_thread sa then Some cdl_object.Untyped else None) = Some y))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 seta word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; x \<in> set [0 , 4 .e. 0x3C]; x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits = ptrFromPAddr word1\<rbrakk> \<Longrightarrow> ptrFromPAddr word1 \<noteq> idle_thread sa
 2. \<And>word1 seta word2 sa pda pt x. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 seta word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; x \<in> set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits = ptrFromPAddr word1
 3. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal (2 subgoals):
 1. \<And>word1 seta word2 sa pda pt x. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a b c. (if a < 4096 then (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)) (word_of_nat a) else None) = Some (cdl_cap.PageTableCap x b c)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 seta word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; x \<in> set [0 , 4 .e. 0x3C]\<rbrakk> \<Longrightarrow> x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask pt_bits = ptrFromPAddr word1
 2. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal (2 subgoals):
 1. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> xa * 4 + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2)) && ~~ mask 10 = ptrFromPAddr word1
 2. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal (3 subgoals):
 1. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> ((vptr >> 12) && 0xFF << 2) + xa * 4 < 2 ^ 10
 2. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> ptrFromPAddr word1 = ptrFromPAddr word1
 3. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal (3 subgoals):
 1. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> ((vptr >> 12) && 0xFF) + xa << 2 < 2 ^ 10
 2. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> ptrFromPAddr word1 = ptrFromPAddr word1
 3. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal (4 subgoals):
 1. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> ((vptr >> 12) && 0xFF) + xa < 2 ^ (10 - 2)
 2. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> 10 < LENGTH(32)
 3. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> ptrFromPAddr word1 = ptrFromPAddr word1
 4. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal (7 subgoals):
 1. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> is_aligned ((vptr >> 12) && 0xFF) 4
 2. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> xa < 2 ^ 4
 3. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> 4 \<le> 10 - 2
 4. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> (vptr >> 12) && 0xFF < 2 ^ (10 - 2)
 5. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> 10 < LENGTH(32)
 6. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> ptrFromPAddr word1 = ptrFromPAddr word1
 7. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal (7 subgoals):
 1. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> is_aligned (vptr >> 12) 4
 2. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> xa < 2 ^ 4
 3. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> 4 \<le> 10 - 2
 4. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> (vptr >> 12) && 0xFF < 2 ^ (10 - 2)
 5. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> 10 < LENGTH(32)
 6. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> ptrFromPAddr word1 = ptrFromPAddr word1
 7. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal (7 subgoals):
 1. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> is_aligned vptr (4 + 12)
 2. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> xa < 2 ^ 4
 3. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> 4 \<le> 10 - 2
 4. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> (vptr >> 12) && 0xFF < 2 ^ (10 - 2)
 5. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> 10 < LENGTH(32)
 6. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> ptrFromPAddr word1 = ptrFromPAddr word1
 7. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal (6 subgoals):
 1. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> xa < 2 ^ 4
 2. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> 4 \<le> 10 - 2
 3. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> (vptr >> 12) && 0xFF < 2 ^ (10 - 2)
 4. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> 10 < LENGTH(32)
 5. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> ptrFromPAddr word1 = ptrFromPAddr word1
 6. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal (5 subgoals):
 1. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> 4 \<le> 10 - 2
 2. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> (vptr >> 12) && 0xFF < 2 ^ (10 - 2)
 3. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> 10 < LENGTH(32)
 4. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> ptrFromPAddr word1 = ptrFromPAddr word1
 5. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal (4 subgoals):
 1. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> (vptr >> 12) && 0xFF < 2 ^ (10 - 2)
 2. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> 10 < LENGTH(32)
 3. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> ptrFromPAddr word1 = ptrFromPAddr word1
 4. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal (3 subgoals):
 1. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> 10 < LENGTH(32)
 2. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> ptrFromPAddr word1 = ptrFromPAddr word1
 3. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal (2 subgoals):
 1. \<And>word1 set word2 sa pda pt xa. \<lbrakk>frslots = {(pd_id, y). y \<in> dom (unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x)))} \<union> {(x, y). (\<exists>a. (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<longrightarrow> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde InvalidPDE = cdl_cap.PageTableCap x b c)) \<and> a < 4096) \<and> (UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> word_of_nat a \<or> (a < 4096 \<longrightarrow> (\<exists>b c. transform_pde (pda (word_of_nat a)) = cdl_cap.PageTableCap x b c)) \<and> a < 4096)) \<and> x \<in> dom (cdl_objects (transform sa))}; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = unat_map (Some \<circ> transform_pde \<circ> (\<lambda>x. if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> x then InvalidPDE else pda x))\<rparr>; pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; xa \<le> 0xF\<rbrakk> \<Longrightarrow> ptrFromPAddr word1 = ptrFromPAddr word1
 2. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal (1 subgoal):
 1. \<And>word1 set word2 sa pda pt. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMLargePage; frslots = all_pd_pt_slots pd pd_ptr (transform sa); cdl_objects (transform sa) pd_ptr = Some pd; valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2) \<notin> kernel_mapping_slots; pda (UCAST(32 \<rightarrow> 12) (lookup_pd_slot pd_ptr vptr && mask pd_bits >> 2)) = PageTablePDE word1 set word2; kheap sa (ptrFromPAddr word1) = Some (ArchObj (arch_kernel_obj.PageTable pt)); is_aligned (ptrFromPAddr word1) 10\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + (ptrFromPAddr word1 + ((vptr >> 12) && 0xFF << 2))) [0 , 4 .e. 0x3C] \<noteq> [] proof (prove)
goal:
No subgoals! proof (state)
this:
dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMLargePage) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMLargePage vm_rights attrib pd_ptr)

goal (2 subgoals):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSection vm_rights attrib pd_ptr)
 2. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSuperSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSuperSection vm_rights attrib pd_ptr) proof (state)
goal (2 subgoals):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSection vm_rights attrib pd_ptr)
 2. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSuperSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSuperSection vm_rights attrib pd_ptr) proof (state)
this:
pdid = pd_ptr
vmsz_aligned vptr ARMSection

goal (2 subgoals):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSection vm_rights attrib pd_ptr)
 2. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSuperSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSuperSection vm_rights attrib pd_ptr) proof (prove)
goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSection vm_rights attrib pd_ptr) proof (prove)
using this:
pdid = pd_ptr
vmsz_aligned vptr ARMSection

goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSection vm_rights attrib pd_ptr) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x xa. x = [transform_pd_slot_ref xa] \<and> transform_pde (SectionPDE base (attrib - {Global}) 0 vm_rights) = FrameCap False (ptrFromPAddr base) vm_rights 20 Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (\<lambda>a. typ_at (AArch APageDirectory) pd_ptr a \<and> valid_idle a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) a)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (returnOk (lookup_pd_slot pd_ptr vptr)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x xa. x = [transform_pd_slot_ref xa] \<and> transform_pde (SectionPDE base (attrib - {Global}) 0 vm_rights) = FrameCap False (ptrFromPAddr base) vm_rights 20 Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (\<lambda>a. typ_at (AArch APageDirectory) pd_ptr a \<and> valid_idle a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) a)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M})) (returnOk (lookup_pd_slot pd_ptr vptr)) proof (prove)
goal (3 subgoals):
 1. \<And>P. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>P. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSection\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> returnOk (lookup_pd_slot pd_ptr vptr) \<lbrace>\<lambda>rv. P\<rbrace>
 3. \<And>s s'. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSection; frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd; typ_at (AArch APageDirectory) pd_ptr s' \<and> valid_idle s' \<and> valid_vspace_objs s' \<and> pspace_aligned s' \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s'); transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> returnOk (lookup_pd_slot pd_ptr vptr) \<lbrace>\<lambda>rv s''. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst (liftE (select {M. set M \<subseteq> all_pd_pt_slots pd pd_ptr s \<and> distinct M}) s)) \<and> (dc \<oplus> (\<lambda>x xa. x = [transform_pd_slot_ref xa] \<and> transform_pde (SectionPDE base (attrib - {Global}) 0 vm_rights) = FrameCap False (ptrFromPAddr base) vm_rights 20 Fake None)) rv' rv\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSection; frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd; typ_at (AArch APageDirectory) pd_ptr s' \<and> valid_idle s' \<and> valid_vspace_objs s' \<and> pspace_aligned s' \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s'); transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> returnOk (lookup_pd_slot pd_ptr vptr) \<lbrace>\<lambda>rv s''. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst (liftE (select {M. set M \<subseteq> all_pd_pt_slots pd pd_ptr s \<and> distinct M}) s)) \<and> (dc \<oplus> (\<lambda>x xa. x = [transform_pd_slot_ref xa] \<and> transform_pde (SectionPDE base (attrib - {Global}) 0 vm_rights) = FrameCap False (ptrFromPAddr base) vm_rights 20 Fake None)) rv' rv\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s s' sa. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSection; frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd; typ_at (AArch APageDirectory) pd_ptr s' \<and> valid_idle s' \<and> valid_vspace_objs s' \<and> pspace_aligned s' \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s'); transform s' = s; s' = sa\<rbrakk> \<Longrightarrow> \<exists>rv'. (\<exists>v'. rv' = Inr v' \<and> set v' \<subseteq> all_pd_pt_slots pd pd_ptr s \<and> distinct v') \<and> (dc \<oplus> (\<lambda>x xa. x = [transform_pd_slot_ref xa] \<and> transform_pde (SectionPDE base (attrib - {Global}) 0 vm_rights) = FrameCap False (ptrFromPAddr base) vm_rights 20 Fake None)) rv' (Inr (lookup_pd_slot pd_ptr vptr)) proof (prove)
goal (1 subgoal):
 1. \<And>sa pda ref. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSection; frslots = all_pd_pt_slots (cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = transform_page_directory_contents pda\<rparr>) pd_ptr (transform sa); valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = transform_page_directory_contents pda\<rparr>\<rbrakk> \<Longrightarrow> transform_pd_slot_ref (lookup_pd_slot pd_ptr vptr) \<in> all_pd_pt_slots (cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = transform_page_directory_contents pda\<rparr>) pd_ptr (transform sa) proof (prove)
goal:
No subgoals! proof (state)
this:
dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSection vm_rights attrib pd_ptr)

goal (1 subgoal):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSuperSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSuperSection vm_rights attrib pd_ptr) proof (state)
goal (1 subgoal):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSuperSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSuperSection vm_rights attrib pd_ptr) proof (state)
this:
pdid = pd_ptr
vmsz_aligned vptr ARMSuperSection

goal (1 subgoal):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSuperSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSuperSection vm_rights attrib pd_ptr) proof (prove)
goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSuperSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSuperSection vm_rights attrib pd_ptr) proof (prove)
using this:
pdid = pd_ptr
vmsz_aligned vptr ARMSuperSection

goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSuperSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSuperSection vm_rights attrib pd_ptr) proof (prove)
using this:
pdid = pd_ptr
vmsz_aligned vptr ARMSuperSection
is_aligned pd_ptr pd_bits

goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSuperSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSuperSection vm_rights attrib pd_ptr) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection; is_aligned pd_ptr pd_bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x xa. x = [transform_pd_slot_ref (hd (map (\<lambda>x. x + xa) superSectionPDE_offsets))] \<and> transform_pde (SuperSectionPDE base (attrib - {Global}) vm_rights) = FrameCap False (ptrFromPAddr base) vm_rights 24 Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (\<lambda>a. typ_at (AArch APageDirectory) pd_ptr a \<and> valid_idle a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) a)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (returnOk (lookup_pd_slot pd_ptr vptr)) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection; is_aligned pd_ptr pd_bits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x xa. x = [transform_pd_slot_ref (hd (map (\<lambda>x. x + xa) superSectionPDE_offsets))] \<and> transform_pde (SuperSectionPDE base (attrib - {Global}) vm_rights) = FrameCap False (ptrFromPAddr base) vm_rights 24 Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (\<lambda>a. typ_at (AArch APageDirectory) pd_ptr a \<and> valid_idle a \<and> valid_vspace_objs a \<and> pspace_aligned a \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) a)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M})) (returnOk (lookup_pd_slot pd_ptr vptr)) proof (prove)
goal (3 subgoals):
 1. \<And>P. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection; is_aligned pd_ptr pd_bits\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>P. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection; is_aligned pd_ptr pd_bits\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> returnOk (lookup_pd_slot pd_ptr vptr) \<lbrace>\<lambda>rv. P\<rbrace>
 3. \<And>s s'. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection; is_aligned pd_ptr pd_bits; frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd; typ_at (AArch APageDirectory) pd_ptr s' \<and> valid_idle s' \<and> valid_vspace_objs s' \<and> pspace_aligned s' \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s'); transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> returnOk (lookup_pd_slot pd_ptr vptr) \<lbrace>\<lambda>rv s''. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst (liftE (select {M. set M \<subseteq> all_pd_pt_slots pd pd_ptr s \<and> distinct M}) s)) \<and> (dc \<oplus> (\<lambda>x xa. x = [transform_pd_slot_ref (hd (map (\<lambda>x. x + xa) superSectionPDE_offsets))] \<and> transform_pde (SuperSectionPDE base (attrib - {Global}) vm_rights) = FrameCap False (ptrFromPAddr base) vm_rights 24 Fake None)) rv' rv\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection; is_aligned pd_ptr pd_bits; frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd; typ_at (AArch APageDirectory) pd_ptr s' \<and> valid_idle s' \<and> valid_vspace_objs s' \<and> pspace_aligned s' \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s'); transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> returnOk (lookup_pd_slot pd_ptr vptr) \<lbrace>\<lambda>rv s''. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst (liftE (select {M. set M \<subseteq> all_pd_pt_slots pd pd_ptr s \<and> distinct M}) s)) \<and> (dc \<oplus> (\<lambda>x xa. x = [transform_pd_slot_ref (hd (map (\<lambda>x. x + xa) superSectionPDE_offsets))] \<and> transform_pde (SuperSectionPDE base (attrib - {Global}) vm_rights) = FrameCap False (ptrFromPAddr base) vm_rights 24 Fake None)) rv' rv\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s s' sa. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection; is_aligned pd_ptr pd_bits; frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd; typ_at (AArch APageDirectory) pd_ptr s' \<and> valid_idle s' \<and> valid_vspace_objs s' \<and> pspace_aligned s' \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s'); transform s' = s; s' = sa\<rbrakk> \<Longrightarrow> \<exists>rv'. (\<exists>v'. rv' = Inr v' \<and> set v' \<subseteq> all_pd_pt_slots pd pd_ptr s \<and> distinct v') \<and> (dc \<oplus> (\<lambda>x xa. x = [transform_pd_slot_ref (hd (map (\<lambda>x. x + xa) superSectionPDE_offsets))] \<and> transform_pde (SuperSectionPDE base (attrib - {Global}) vm_rights) = FrameCap False (ptrFromPAddr base) vm_rights 24 Fake None)) rv' (Inr (lookup_pd_slot pd_ptr vptr)) proof (prove)
goal (1 subgoal):
 1. \<And>sa pda ref. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection; is_aligned pd_ptr pd_bits; frslots = all_pd_pt_slots (cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = transform_page_directory_contents pda\<rparr>) pd_ptr (transform sa); valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = transform_page_directory_contents pda\<rparr>\<rbrakk> \<Longrightarrow> transform_pd_slot_ref (hd (map (\<lambda>x. x + lookup_pd_slot pd_ptr vptr) superSectionPDE_offsets)) \<in> all_pd_pt_slots (cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = transform_page_directory_contents pda\<rparr>) pd_ptr (transform sa) proof (prove)
goal (2 subgoals):
 1. \<And>sa pda ref. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection; is_aligned pd_ptr pd_bits; frslots = all_pd_pt_slots (cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = transform_page_directory_contents pda\<rparr>) pd_ptr (transform sa); valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = transform_page_directory_contents pda\<rparr>\<rbrakk> \<Longrightarrow> set (map transform_pd_slot_ref (map (\<lambda>x. x + lookup_pd_slot pd_ptr vptr) superSectionPDE_offsets)) \<subseteq> all_pd_pt_slots (cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = transform_page_directory_contents pda\<rparr>) pd_ptr (transform sa)
 2. \<And>sa pda ref. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection; is_aligned pd_ptr pd_bits; frslots = all_pd_pt_slots (cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = transform_page_directory_contents pda\<rparr>) pd_ptr (transform sa); valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = transform_page_directory_contents pda\<rparr>\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + lookup_pd_slot pd_ptr vptr) superSectionPDE_offsets \<noteq> [] proof (prove)
goal (2 subgoals):
 1. \<And>sa pda ref a b x. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection; is_aligned pd_ptr pd_bits; frslots = all_pd_pt_slots (cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = transform_page_directory_contents pda\<rparr>) pd_ptr (transform sa); valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = transform_page_directory_contents pda\<rparr>; (a, b) = transform_pd_slot_ref (x + lookup_pd_slot pd_ptr vptr); x \<in> set superSectionPDE_offsets\<rbrakk> \<Longrightarrow> transform_pd_slot_ref (x + lookup_pd_slot pd_ptr vptr) \<in> all_pd_pt_slots (cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = transform_page_directory_contents pda\<rparr>) pd_ptr (transform sa)
 2. \<And>sa pda ref. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection; is_aligned pd_ptr pd_bits; frslots = all_pd_pt_slots (cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = transform_page_directory_contents pda\<rparr>) pd_ptr (transform sa); valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = transform_page_directory_contents pda\<rparr>\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + lookup_pd_slot pd_ptr vptr) superSectionPDE_offsets \<noteq> [] proof (prove)
goal (1 subgoal):
 1. \<And>sa pda ref. \<lbrakk>pdid = pd_ptr; vmsz_aligned vptr ARMSuperSection; is_aligned pd_ptr pd_bits; frslots = all_pd_pt_slots (cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = transform_page_directory_contents pda\<rparr>) pd_ptr (transform sa); valid_idle sa; kheap sa pd_ptr = Some (ArchObj (arch_kernel_obj.PageDirectory pda)); valid_vspace_objs sa; pspace_aligned sa; (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) sa; pd = cdl_object.PageDirectory \<lparr>cdl_page_directory_caps = transform_page_directory_contents pda\<rparr>\<rbrakk> \<Longrightarrow> map (\<lambda>x. x + lookup_pd_slot pd_ptr vptr) superSectionPDE_offsets \<noteq> [] proof (prove)
goal:
No subgoals! proof (state)
this:
dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize ARMSuperSection) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pd_ptr s \<and> cdl_objects s pd_ptr = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr ARMSuperSection vm_rights attrib pd_ptr)

goal:
No subgoals! proof (state)
this:
dcorres (dc \<oplus> (\<lambda>rv rv'. rv = (case rv' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case rv' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False (ptrFromPAddr base) vm_rights (pageBitsForSize pgsz) Fake None)) (\<lambda>s. frslots = all_pd_pt_slots pd pdid s \<and> cdl_objects s pdid = Some pd) (typ_at (AArch APageDirectory) pd_ptr and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot pd_ptr vptr && ~~ mask pd_bits)) s)) (liftE (select {M. set M \<subseteq> frslots \<and> distinct M}) \<sqinter> throw) (create_mapping_entries base vptr pgsz vm_rights attrib pd_ptr)

goal:
No subgoals!