theory VSpace_C

lemma doFlush_ccorres:
  "ccorres dc xfdc (\<lambda>s. vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5
        \<and> unat (ve - vs) \<le> gsMaxObjectSize s)
     (\<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace> \<inter> \<lbrace>\<acute>pstart = ps\<rbrace>) []
     (doMachineOp (doFlush t vs ve ps)) (Call doFlush_'proc)" apply (cinit' lift: pstart_') apply (unfold doMachineOp_bind doFlush_def) apply (rule ccorres_Guard_Seq) apply (rule ccorres_basic_srnoop) apply (simp only: ccorres_seq_skip) apply (rule_tac xf'=invLabel___int_' in ccorres_abstract, ceqv, rename_tac invlabel) apply (rule_tac P="flushtype_relation t invlabel" in ccorres_gen_asm2) apply (rule_tac xf'=start_' in ccorres_abstract, ceqv, rename_tac start') apply (rule_tac P="start' = vs" in ccorres_gen_asm2) apply (rule_tac xf'=end_' in ccorres_abstract, ceqv, rename_tac end') apply (rule_tac P="end' = ve" in ccorres_gen_asm2) apply (simp only: dmo_flushtype_case) apply wpc apply (rule ccorres_cond_true) apply (ctac (no_vcg) add: cleanCacheRange_RAM_ccorres) apply (rule ccorres_cond_false) apply (rule ccorres_cond_true) apply (ctac (no_vcg) add: invalidateCacheRange_RAM_ccorres) apply (rule ccorres_cond_false) apply (rule ccorres_cond_false) apply (rule ccorres_cond_true) apply (ctac (no_vcg) add: cleanInvalidateCacheRange_RAM_ccorres) apply (rule ccorres_cond_false) apply (rule ccorres_cond_false) apply (rule ccorres_cond_false) apply (rule ccorres_cond_true) apply (simp add: empty_fail_cond empty_fail_cleanCacheRange_PoU empty_fail_dsb
                      empty_fail_invalidateCacheRange_I empty_fail_branchFlushRange empty_fail_isb
                      doMachineOp_bind) apply (rule ccorres_rhs_assoc)+ apply (ctac (no_vcg) add: cleanCacheRange_PoU_ccorres) apply (ctac (no_vcg) add: dsb_ccorres) apply (ctac (no_vcg) add: invalidateCacheRange_I_ccorres) apply (ctac (no_vcg) add: branchFlushRange_ccorres) apply (ctac (no_vcg) add: isb_ccorres) apply wp+ apply simp apply (clarsimp simp: Collect_const_mem) apply (auto simp: flushtype_relation_def
                    Kernel_C.ARMPageClean_Data_def Kernel_C.ARMPDClean_Data_def
                    Kernel_C.ARMPageInvalidate_Data_def Kernel_C.ARMPDInvalidate_Data_def
                    Kernel_C.ARMPageCleanInvalidate_Data_def Kernel_C.ARMPDCleanInvalidate_Data_def
                    Kernel_C.ARMPageUnify_Instruction_def Kernel_C.ARMPDUnify_Instruction_def
              dest: ghost_assertion_size_logic[rotated]
             split: ARM_H.flush_type.splits) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (\<lambda>s. vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) (\<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace> \<inter> \<lbrace>\<acute>pstart = ps\<rbrace>) [] (doMachineOp (doFlush t vs ve ps)) (Call doFlush_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>pstart. pstart = ps \<Longrightarrow> ccorres dc xfdc (?Q523 pstart) (?Q'523 pstart) [SKIP] (doMachineOp (doFlush t vs ve ps)) (Guard GhostStateError \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
IF \<acute>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<acute>invLabel___int = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(\<acute>start,\<acute>end,pstart)
ELSE
  IF \<acute>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<acute>invLabel___int = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(\<acute>start,\<acute>end,pstart)
ELSE
  IF \<acute>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<acute>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(\<acute>start,\<acute>end,pstart)
ELSE
  IF \<acute>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<acute>invLabel___int = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(\<acute>start,\<acute>end,pstart);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(\<acute>start,\<acute>end,pstart);;
CALL branchFlushRange_'proc(\<acute>start,\<acute>end,pstart);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ?Q523 pstart s \<and> s' \<in> ?Q'523 pstart proof (prove)
goal (2 subgoals):
 1. \<And>pstart. pstart = ps \<Longrightarrow> ccorres dc xfdc (?Q523 pstart) (?Q'523 pstart) [SKIP] (doMachineOp (case t of ARM_H.Clean \<Rightarrow> cleanCacheRange_RAM vs ve ps | ARM_H.Invalidate \<Rightarrow> invalidateCacheRange_RAM vs ve ps | ARM_H.CleanInvalidate \<Rightarrow> cleanInvalidateCacheRange_RAM vs ve ps | ARM_H.Unify \<Rightarrow> do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (Guard GhostStateError \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
IF \<acute>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<acute>invLabel___int = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(\<acute>start,\<acute>end,pstart)
ELSE
  IF \<acute>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<acute>invLabel___int = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(\<acute>start,\<acute>end,pstart)
ELSE
  IF \<acute>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<acute>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(\<acute>start,\<acute>end,pstart)
ELSE
  IF \<acute>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<acute>invLabel___int = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(\<acute>start,\<acute>end,pstart);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(\<acute>start,\<acute>end,pstart);;
CALL branchFlushRange_'proc(\<acute>start,\<acute>end,pstart);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ?Q523 pstart s \<and> s' \<in> ?Q'523 pstart proof (prove)
goal (2 subgoals):
 1. \<And>pstart. pstart = ps \<Longrightarrow> ccorres dc xfdc (?Q523 pstart) (?C'529 pstart) [SKIP] (doMachineOp (case t of ARM_H.Clean \<Rightarrow> cleanCacheRange_RAM vs ve ps | ARM_H.Invalidate \<Rightarrow> invalidateCacheRange_RAM vs ve ps | ARM_H.CleanInvalidate \<Rightarrow> cleanInvalidateCacheRange_RAM vs ve ps | ARM_H.Unify \<Rightarrow> do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (\<acute>globals :== ghost'state_'_update id;;
IF \<acute>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<acute>invLabel___int = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(\<acute>start,\<acute>end,pstart)
ELSE
  IF \<acute>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<acute>invLabel___int = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(\<acute>start,\<acute>end,pstart)
ELSE
  IF \<acute>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<acute>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(\<acute>start,\<acute>end,pstart)
ELSE
  IF \<acute>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<acute>invLabel___int = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(\<acute>start,\<acute>end,pstart);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(\<acute>start,\<acute>end,pstart);;
CALL branchFlushRange_'proc(\<acute>start,\<acute>end,pstart);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ?Q523 pstart s \<and> s' \<in> ?C'529 pstart \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>pstart. pstart = ps \<Longrightarrow> ccorres dc xfdc (?Q523 pstart) (?C'529 pstart) [SKIP] (doMachineOp (case t of ARM_H.Clean \<Rightarrow> cleanCacheRange_RAM vs ve ps | ARM_H.Invalidate \<Rightarrow> invalidateCacheRange_RAM vs ve ps | ARM_H.CleanInvalidate \<Rightarrow> cleanInvalidateCacheRange_RAM vs ve ps | ARM_H.Unify \<Rightarrow> do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF \<acute>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<acute>invLabel___int = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(\<acute>start,\<acute>end,pstart)
ELSE
  IF \<acute>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<acute>invLabel___int = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(\<acute>start,\<acute>end,pstart)
ELSE
  IF \<acute>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<acute>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(\<acute>start,\<acute>end,pstart)
ELSE
  IF \<acute>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<acute>invLabel___int = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(\<acute>start,\<acute>end,pstart);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(\<acute>start,\<acute>end,pstart);;
CALL branchFlushRange_'proc(\<acute>start,\<acute>end,pstart);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 3. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> ?C'529 pstart\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> ?C'529 pstart
 4. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ?Q523 pstart s \<and> s' \<in> ?C'529 pstart \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>pstart. pstart = ps \<Longrightarrow> ccorres dc xfdc (?Q523 ps) (?C'529 ps) [SKIP] (doMachineOp (case t of ARM_H.Clean \<Rightarrow> cleanCacheRange_RAM vs ve ps | ARM_H.Invalidate \<Rightarrow> invalidateCacheRange_RAM vs ve ps | ARM_H.CleanInvalidate \<Rightarrow> cleanInvalidateCacheRange_RAM vs ve ps | ARM_H.Unify \<Rightarrow> do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF \<acute>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<acute>invLabel___int = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(\<acute>start,\<acute>end,ps)
ELSE
  IF \<acute>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<acute>invLabel___int = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(\<acute>start,\<acute>end,ps)
ELSE
  IF \<acute>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<acute>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(\<acute>start,\<acute>end,ps)
ELSE
  IF \<acute>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<acute>invLabel___int = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(\<acute>start,\<acute>end,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(\<acute>start,\<acute>end,ps);;
CALL branchFlushRange_'proc(\<acute>start,\<acute>end,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 3. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> ?C'529 pstart\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> ?C'529 pstart
 4. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ?Q523 pstart s \<and> s' \<in> ?C'529 pstart \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>pstart invlabel. pstart = ps \<Longrightarrow> ccorres dc xfdc (?Q523 ps) (?G'539 invlabel) [SKIP] (doMachineOp (case t of ARM_H.Clean \<Rightarrow> cleanCacheRange_RAM vs ve ps | ARM_H.Invalidate \<Rightarrow> invalidateCacheRange_RAM vs ve ps | ARM_H.CleanInvalidate \<Rightarrow> cleanInvalidateCacheRange_RAM vs ve ps | ARM_H.Unify \<Rightarrow> do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(\<acute>start,\<acute>end,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(\<acute>start,\<acute>end,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(\<acute>start,\<acute>end,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(\<acute>start,\<acute>end,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(\<acute>start,\<acute>end,ps);;
CALL branchFlushRange_'proc(\<acute>start,\<acute>end,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 3. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> ?G'537 pstart s}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> ?G'537 pstart s}
 4. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ?Q523 pstart s \<and> s' \<in> {s. s \<in> ?G'537 pstart s} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
\<lambda>s. ?G'539 (invLabel___int_' s) \<equiv>\<^sup>? ?G'537 ps proof (prove)
goal (4 subgoals):
 1. \<And>pstart invlabel. \<lbrakk>pstart = ps; flushtype_relation t invlabel\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q523 ps) (?G'862 invlabel) [SKIP] (doMachineOp (case t of ARM_H.Clean \<Rightarrow> cleanCacheRange_RAM vs ve ps | ARM_H.Invalidate \<Rightarrow> invalidateCacheRange_RAM vs ve ps | ARM_H.CleanInvalidate \<Rightarrow> cleanInvalidateCacheRange_RAM vs ve ps | ARM_H.Unify \<Rightarrow> do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(\<acute>start,\<acute>end,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(\<acute>start,\<acute>end,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(\<acute>start,\<acute>end,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(\<acute>start,\<acute>end,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(\<acute>start,\<acute>end,ps);;
CALL branchFlushRange_'proc(\<acute>start,\<acute>end,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 3. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> ?G'860 pstart s \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> ?G'860 pstart s \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 4. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ?Q523 pstart s \<and> s' \<in> {s. s \<in> ?G'860 pstart s \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
\<lambda>s. ?G'862 (invLabel___int_' s) \<equiv>\<^sup>? ?G'860 ps proof (prove)
goal (4 subgoals):
 1. \<And>pstart invlabel start'. \<lbrakk>pstart = ps; flushtype_relation t invlabel\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q523 ps) (?G'868 invlabel start') [SKIP] (doMachineOp (case t of ARM_H.Clean \<Rightarrow> cleanCacheRange_RAM vs ve ps | ARM_H.Invalidate \<Rightarrow> invalidateCacheRange_RAM vs ve ps | ARM_H.CleanInvalidate \<Rightarrow> cleanInvalidateCacheRange_RAM vs ve ps | ARM_H.Unify \<Rightarrow> do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(start',\<acute>end,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(start',\<acute>end,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(start',\<acute>end,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(start',\<acute>end,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(start',\<acute>end,ps);;
CALL branchFlushRange_'proc(start',\<acute>end,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 3. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> ?G'866 pstart s sa} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> ?G'866 pstart s sa} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 4. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ?Q523 pstart s \<and> s' \<in> {s. s \<in> {sa. sa \<in> ?G'866 pstart s sa} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
\<lambda>s sa. ?G'868 (invLabel___int_' s) (start_' sa) \<equiv>\<^sup>? ?G'866 ps proof (prove)
goal (4 subgoals):
 1. \<And>pstart invlabel start'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q523 ps) (?G'1184 invlabel start') [SKIP] (doMachineOp (case t of ARM_H.Clean \<Rightarrow> cleanCacheRange_RAM vs ve ps | ARM_H.Invalidate \<Rightarrow> invalidateCacheRange_RAM vs ve ps | ARM_H.CleanInvalidate \<Rightarrow> cleanInvalidateCacheRange_RAM vs ve ps | ARM_H.Unify \<Rightarrow> do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(start',\<acute>end,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(start',\<acute>end,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(start',\<acute>end,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(start',\<acute>end,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(start',\<acute>end,ps);;
CALL branchFlushRange_'proc(start',\<acute>end,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 3. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> ?G'1182 pstart s sa \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> ?G'1182 pstart s sa \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 4. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ?Q523 pstart s \<and> s' \<in> {s. s \<in> {sa. sa \<in> ?G'1182 pstart s sa \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
\<lambda>s sa. ?G'1184 (invLabel___int_' s) (start_' sa) \<equiv>\<^sup>? ?G'1182 ps proof (prove)
goal (4 subgoals):
 1. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q523 ps) (?G'1190 invlabel start' end') [SKIP] (doMachineOp (case t of ARM_H.Clean \<Rightarrow> cleanCacheRange_RAM vs ve ps | ARM_H.Invalidate \<Rightarrow> invalidateCacheRange_RAM vs ve ps | ARM_H.CleanInvalidate \<Rightarrow> cleanInvalidateCacheRange_RAM vs ve ps | ARM_H.Unify \<Rightarrow> do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(start',end',ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(start',end',ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(start',end',ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(start',end',ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(start',end',ps);;
CALL branchFlushRange_'proc(start',end',ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 3. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> ?G'1188 pstart s sa sb} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> ?G'1188 pstart s sa sb} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 4. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ?Q523 pstart s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> ?G'1188 pstart s sa sb} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
\<lambda>s sa sb. ?G'1190 (invLabel___int_' s) (start_' sa) (end_' sb) \<equiv>\<^sup>? ?G'1188 ps proof (prove)
goal (4 subgoals):
 1. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q523 ps) (?G'1507 invlabel start' end') [SKIP] (doMachineOp (case t of ARM_H.Clean \<Rightarrow> cleanCacheRange_RAM vs ve ps | ARM_H.Invalidate \<Rightarrow> invalidateCacheRange_RAM vs ve ps | ARM_H.CleanInvalidate \<Rightarrow> cleanInvalidateCacheRange_RAM vs ve ps | ARM_H.Unify \<Rightarrow> do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(start',end',ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(start',end',ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(start',end',ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(start',end',ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(start',end',ps);;
CALL branchFlushRange_'proc(start',end',ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 3. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> ?G'1505 pstart s sa sb \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> ?G'1505 pstart s sa sb \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 4. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ?Q523 pstart s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> ?G'1505 pstart s sa sb \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
\<lambda>s sa sb. ?G'1507 (invLabel___int_' s) (start_' sa) (end_' sb) \<equiv>\<^sup>? ?G'1505 ps proof (prove)
goal (4 subgoals):
 1. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q523 ps) (?G'1507 invlabel vs ve) [SKIP] (case t of ARM_H.Clean \<Rightarrow> doMachineOp (cleanCacheRange_RAM vs ve ps) | ARM_H.Invalidate \<Rightarrow> doMachineOp (invalidateCacheRange_RAM vs ve ps) | ARM_H.CleanInvalidate \<Rightarrow> doMachineOp (cleanInvalidateCacheRange_RAM vs ve ps) | ARM_H.Unify \<Rightarrow> doMachineOp (do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 3. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> ?G'1505 pstart s sa sb \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> ?G'1505 pstart s sa sb \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 4. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ?Q523 pstart s \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> ?G'1505 pstart s sa sb \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
\<lambda>s sa sb. ?G'1507 (invLabel___int_' s) (start_' sa) (end_' sb) \<equiv>\<^sup>? ?G'1505 ps proof (prove)
goal (7 subgoals):
 1. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.Clean\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1532 ps) (?R''1539 invlabel vs ve) [SKIP] (doMachineOp (cleanCacheRange_RAM vs ve ps)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.Invalidate\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1531 ps) (?R''1537 invlabel vs ve) [SKIP] (doMachineOp (invalidateCacheRange_RAM vs ve ps)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 3. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.CleanInvalidate\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1530 ps) (?R''1535 invlabel vs ve) [SKIP] (doMachineOp (cleanInvalidateCacheRange_RAM vs ve ps)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 4. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.Unify\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1529 ps) (?R''1533 invlabel vs ve) [SKIP] (doMachineOp (do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 5. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 6. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> ?R''1544 pstart s sa sb} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> ?R''1543 pstart s sa sb} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R''1542 pstart s sa sb} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> ?R''1544 pstart s sa sb} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> ?R''1543 pstart s sa sb} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R''1542 pstart s sa sb} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 7. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> ?R1532 pstart s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ?R1531 pstart s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ?R1530 pstart s) \<and> (t = ARM_H.Unify \<longrightarrow> ?R1529 pstart s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> ?R''1544 pstart s sa sb} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> ?R''1543 pstart s sa sb} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R''1542 pstart s sa sb} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
?R''1544 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R''1539 (invLabel___int_' s) (start_' sa) (end_' sb)
?R''1543 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R''1537 (invLabel___int_' s) (start_' sa) (end_' sb)
?R''1542 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R''1535 (invLabel___int_' s) (start_' sa) (end_' sb)
?R''1541 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R''1533 (invLabel___int_' s) (start_' sa) (end_' sb) proof (prove)
goal (7 subgoals):
 1. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.Clean\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1532 ps) (?R'1559 invlabel vs ve) [SKIP] (doMachineOp (cleanCacheRange_RAM vs ve ps)) (CALL cleanCacheRange_RAM_'proc(vs,ve,ps))
 2. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.Invalidate\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1531 ps) (?R''1537 invlabel vs ve) [SKIP] (doMachineOp (invalidateCacheRange_RAM vs ve ps)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 3. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.CleanInvalidate\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1530 ps) (?R''1535 invlabel vs ve) [SKIP] (doMachineOp (cleanInvalidateCacheRange_RAM vs ve ps)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 4. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.Unify\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1529 ps) (?R''1533 invlabel vs ve) [SKIP] (doMachineOp (do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 5. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 6. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> ?R'1560 pstart s sa sb \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> ?R''1543 pstart s sa sb} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R''1542 pstart s sa sb} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> ?R'1560 pstart s sa sb \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> ?R''1543 pstart s sa sb} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R''1542 pstart s sa sb} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 7. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> ?R1532 pstart s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ?R1531 pstart s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ?R1530 pstart s) \<and> (t = ARM_H.Unify \<longrightarrow> ?R1529 pstart s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> ?R'1560 pstart s sa sb \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> ?R''1543 pstart s sa sb} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R''1542 pstart s sa sb} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
?R'1560 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R'1559 (invLabel___int_' s) (start_' sa) (end_' sb)
?R''1543 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R''1537 (invLabel___int_' s) (start_' sa) (end_' sb)
?R''1542 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R''1535 (invLabel___int_' s) (start_' sa) (end_' sb)
?R''1541 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R''1533 (invLabel___int_' s) (start_' sa) (end_' sb) proof (prove)
goal (6 subgoals):
 1. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.Invalidate\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1531 ps) (?R''1537 invlabel vs ve) [SKIP] (doMachineOp (invalidateCacheRange_RAM vs ve ps)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.CleanInvalidate\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1530 ps) (?R''1535 invlabel vs ve) [SKIP] (doMachineOp (cleanInvalidateCacheRange_RAM vs ve ps)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 3. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.Unify\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1529 ps) (?R''1533 invlabel vs ve) [SKIP] (doMachineOp (do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 4. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 5. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> ?R''1543 pstart s sa sb} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R''1542 pstart s sa sb} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> ?R''1543 pstart s sa sb} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R''1542 pstart s sa sb} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 6. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ?R1531 pstart s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ?R1530 pstart s) \<and> (t = ARM_H.Unify \<longrightarrow> ?R1529 pstart s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> ?R''1543 pstart s sa sb} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R''1542 pstart s sa sb} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
?R''1543 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R''1537 (invLabel___int_' s) (start_' sa) (end_' sb)
?R''1542 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R''1535 (invLabel___int_' s) (start_' sa) (end_' sb)
?R''1541 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R''1533 (invLabel___int_' s) (start_' sa) (end_' sb) proof (prove)
goal (6 subgoals):
 1. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.Invalidate\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1531 ps) (?R'1579 invlabel vs ve) [SKIP] (doMachineOp (invalidateCacheRange_RAM vs ve ps)) (IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 2. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.CleanInvalidate\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1530 ps) (?R''1535 invlabel vs ve) [SKIP] (doMachineOp (cleanInvalidateCacheRange_RAM vs ve ps)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 3. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.Unify\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1529 ps) (?R''1533 invlabel vs ve) [SKIP] (doMachineOp (do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 4. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 5. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> ?R'1580 pstart s sa sb \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R''1542 pstart s sa sb} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> ?R'1580 pstart s sa sb \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R''1542 pstart s sa sb} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 6. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ?R1531 pstart s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ?R1530 pstart s) \<and> (t = ARM_H.Unify \<longrightarrow> ?R1529 pstart s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> ?R'1580 pstart s sa sb \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R''1542 pstart s sa sb} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
?R'1580 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R'1579 (invLabel___int_' s) (start_' sa) (end_' sb)
?R''1542 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R''1535 (invLabel___int_' s) (start_' sa) (end_' sb)
?R''1541 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R''1533 (invLabel___int_' s) (start_' sa) (end_' sb) proof (prove)
goal (6 subgoals):
 1. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.Invalidate\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1531 ps) (?R'1585 invlabel vs ve) [SKIP] (doMachineOp (invalidateCacheRange_RAM vs ve ps)) (CALL invalidateCacheRange_RAM_'proc(vs,ve,ps))
 2. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.CleanInvalidate\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1530 ps) (?R''1535 invlabel vs ve) [SKIP] (doMachineOp (cleanInvalidateCacheRange_RAM vs ve ps)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 3. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.Unify\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1529 ps) (?R''1533 invlabel vs ve) [SKIP] (doMachineOp (do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 4. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 5. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> ?R'1586 pstart s sa sb \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R''1542 pstart s sa sb} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> ?R'1586 pstart s sa sb \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R''1542 pstart s sa sb} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 6. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ?R1531 pstart s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ?R1530 pstart s) \<and> (t = ARM_H.Unify \<longrightarrow> ?R1529 pstart s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> ?R'1586 pstart s sa sb \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R''1542 pstart s sa sb} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
?R'1586 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R'1585 (invLabel___int_' s) (start_' sa) (end_' sb)
?R''1542 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R''1535 (invLabel___int_' s) (start_' sa) (end_' sb)
?R''1541 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R''1533 (invLabel___int_' s) (start_' sa) (end_' sb) proof (prove)
goal (5 subgoals):
 1. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.CleanInvalidate\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1530 ps) (?R''1535 invlabel vs ve) [SKIP] (doMachineOp (cleanInvalidateCacheRange_RAM vs ve ps)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.Unify\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1529 ps) (?R''1533 invlabel vs ve) [SKIP] (doMachineOp (do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 3. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 4. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R''1542 pstart s sa sb} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R''1542 pstart s sa sb} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 5. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5)) s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ?R1530 pstart s) \<and> (t = ARM_H.Unify \<longrightarrow> ?R1529 pstart s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R''1542 pstart s sa sb} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
?R''1542 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R''1535 (invLabel___int_' s) (start_' sa) (end_' sb)
?R''1541 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R''1533 (invLabel___int_' s) (start_' sa) (end_' sb) proof (prove)
goal (5 subgoals):
 1. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.CleanInvalidate\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1530 ps) (?R'1605 invlabel vs ve) [SKIP] (doMachineOp (cleanInvalidateCacheRange_RAM vs ve ps)) (IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 2. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.Unify\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1529 ps) (?R''1533 invlabel vs ve) [SKIP] (doMachineOp (do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 3. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 4. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R'1606 pstart s sa sb \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R'1606 pstart s sa sb \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 5. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5)) s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ?R1530 pstart s) \<and> (t = ARM_H.Unify \<longrightarrow> ?R1529 pstart s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R'1606 pstart s sa sb \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
?R'1606 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R'1605 (invLabel___int_' s) (start_' sa) (end_' sb)
?R''1541 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R''1533 (invLabel___int_' s) (start_' sa) (end_' sb) proof (prove)
goal (5 subgoals):
 1. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.CleanInvalidate\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1530 ps) (?R'1611 invlabel vs ve) [SKIP] (doMachineOp (cleanInvalidateCacheRange_RAM vs ve ps)) (IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI)
 2. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.Unify\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1529 ps) (?R''1533 invlabel vs ve) [SKIP] (doMachineOp (do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 3. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 4. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R'1612 pstart s sa sb \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R'1612 pstart s sa sb \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 5. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5)) s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ?R1530 pstart s) \<and> (t = ARM_H.Unify \<longrightarrow> ?R1529 pstart s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R'1612 pstart s sa sb \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
?R'1612 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R'1611 (invLabel___int_' s) (start_' sa) (end_' sb)
?R''1541 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R''1533 (invLabel___int_' s) (start_' sa) (end_' sb) proof (prove)
goal (5 subgoals):
 1. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.CleanInvalidate\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1530 ps) (?R'1617 invlabel vs ve) [SKIP] (doMachineOp (cleanInvalidateCacheRange_RAM vs ve ps)) (CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps))
 2. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.Unify\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1529 ps) (?R''1533 invlabel vs ve) [SKIP] (doMachineOp (do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 3. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 4. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R'1618 pstart s sa sb \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R'1618 pstart s sa sb \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 5. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5)) s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ?R1530 pstart s) \<and> (t = ARM_H.Unify \<longrightarrow> ?R1529 pstart s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> ?R'1618 pstart s sa sb \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
?R'1618 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R'1617 (invLabel___int_' s) (start_' sa) (end_' sb)
?R''1541 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R''1533 (invLabel___int_' s) (start_' sa) (end_' sb) proof (prove)
goal (4 subgoals):
 1. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.Unify\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1529 ps) (?R''1533 invlabel vs ve) [SKIP] (doMachineOp (do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF invlabel = Kernel_C.ARMPageClean_Data \<or> invlabel = Kernel_C.ARMPDClean_Data THEN
  CALL cleanCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI
FI)
 2. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 3. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 4. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5)) s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - ve) \<le> gsMaxObjectSize (?s1632 pstart))) s) \<and> (t = ARM_H.Unify \<longrightarrow> ?R1529 pstart s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R''1541 pstart s sa sb})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
?R''1541 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R''1533 (invLabel___int_' s) (start_' sa) (end_' sb) proof (prove)
goal (4 subgoals):
 1. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.Unify\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1529 ps) (?R'1640 invlabel vs ve) [SKIP] (doMachineOp (do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF invlabel = Kernel_C.ARMPageInvalidate_Data \<or> invlabel = Kernel_C.ARMPDInvalidate_Data THEN
  CALL invalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI
FI)
 2. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 3. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R'1641 pstart s sa sb \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R'1641 pstart s sa sb \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 4. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5)) s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - ve) \<le> gsMaxObjectSize (?s1632 pstart))) s) \<and> (t = ARM_H.Unify \<longrightarrow> ?R1529 pstart s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R'1641 pstart s sa sb \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
?R'1641 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R'1640 (invLabel___int_' s) (start_' sa) (end_' sb) proof (prove)
goal (4 subgoals):
 1. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.Unify\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1529 ps) (?R'1646 invlabel vs ve) [SKIP] (doMachineOp (do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF invlabel = Kernel_C.ARMPageCleanInvalidate_Data \<or> invlabel = Kernel_C.ARMPDCleanInvalidate_Data THEN
  CALL cleanInvalidateCacheRange_RAM_'proc(vs,ve,ps)
ELSE
  IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI
FI)
 2. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 3. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R'1647 pstart s sa sb \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R'1647 pstart s sa sb \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 4. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5)) s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - ve) \<le> gsMaxObjectSize (?s1632 pstart))) s) \<and> (t = ARM_H.Unify \<longrightarrow> ?R1529 pstart s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R'1647 pstart s sa sb \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
?R'1647 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R'1646 (invLabel___int_' s) (start_' sa) (end_' sb) proof (prove)
goal (4 subgoals):
 1. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.Unify\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1529 ps) (?R'1652 invlabel vs ve) [SKIP] (doMachineOp (do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (IF invlabel = Kernel_C.ARMPageUnify_Instruction \<or> invlabel = Kernel_C.ARMPDUnify_Instruction THEN
  CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()
ELSE
  Guard DontReach {} SKIP
FI)
 2. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 3. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R'1653 pstart s sa sb \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R'1653 pstart s sa sb \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 4. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5)) s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - ve) \<le> gsMaxObjectSize (?s1632 pstart))) s) \<and> (t = ARM_H.Unify \<longrightarrow> ?R1529 pstart s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R'1653 pstart s sa sb \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
?R'1653 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R'1652 (invLabel___int_' s) (start_' sa) (end_' sb) proof (prove)
goal (4 subgoals):
 1. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation t invlabel; start' = vs; end' = ve; t = ARM_H.Unify\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1529 ps) (?R'1658 invlabel vs ve) [SKIP] (doMachineOp (do cleanCacheRange_PoU vs ve ps;
dsb;
invalidateCacheRange_I vs ve ps;
branchFlushRange vs ve ps;
isb
od)) (CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc())
 2. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 3. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R'1659 pstart s sa sb \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R'1659 pstart s sa sb \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 4. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5)) s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - ve) \<le> gsMaxObjectSize (?s1632 pstart))) s) \<and> (t = ARM_H.Unify \<longrightarrow> ?R1529 pstart s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R'1659 pstart s sa sb \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
?R'1659 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R'1658 (invLabel___int_' s) (start_' sa) (end_' sb) proof (prove)
goal (4 subgoals):
 1. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation ARM_H.Unify invlabel; start' = vs; end' = ve; t = ARM_H.Unify\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1529 ps) (?R'1658 invlabel vs ve) [SKIP] (do rv <- doMachineOp (cleanCacheRange_PoU vs ve ps);
rv <- doMachineOp dsb;
rv <- doMachineOp (invalidateCacheRange_I vs ve ps);
rv <- doMachineOp (branchFlushRange vs ve ps);
doMachineOp isb
od) (CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
CALL dsb_'proc();;
CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc())
 2. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 3. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R'1659 pstart s sa sb \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R'1659 pstart s sa sb \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 4. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5)) s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - ve) \<le> gsMaxObjectSize (?s1632 pstart))) s) \<and> (t = ARM_H.Unify \<longrightarrow> ?R1529 pstart s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R'1659 pstart s sa sb \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
?R'1659 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R'1658 (invLabel___int_' s) (start_' sa) (end_' sb) proof (prove)
goal (4 subgoals):
 1. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation ARM_H.Unify invlabel; start' = vs; end' = ve; t = ARM_H.Unify\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1529 ps) (?R'1658 invlabel vs ve) [SKIP] (do rv <- doMachineOp (cleanCacheRange_PoU vs ve ps);
rv <- doMachineOp dsb;
rv <- doMachineOp (invalidateCacheRange_I vs ve ps);
rv <- doMachineOp (branchFlushRange vs ve ps);
doMachineOp isb
od) (CALL cleanCacheRange_PoU_'proc(vs,ve,ps);;
(CALL dsb_'proc();;
(CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
(CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()))))
 2. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 3. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R'1659 pstart s sa sb \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R'1659 pstart s sa sb \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 4. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5)) s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - ve) \<le> gsMaxObjectSize (?s1632 pstart))) s) \<and> (t = ARM_H.Unify \<longrightarrow> ?R1529 pstart s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> ?R'1659 pstart s sa sb \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
?R'1659 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?R'1658 (invLabel___int_' s) (start_' sa) (end_' sb) proof (prove)
goal (5 subgoals):
 1. \<And>pstart invlabel start' end' rv xfdca. \<lbrakk>pstart = ps; flushtype_relation ARM_H.Unify invlabel; start' = vs; end' = ve; t = ARM_H.Unify; dc rv xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1681 pstart invlabel start' end' rv) (?Q'1699 invlabel rv xfdca) [SKIP] (do rv <- doMachineOp dsb;
rv <- doMachineOp (invalidateCacheRange_I vs ve ps);
rv <- doMachineOp (branchFlushRange vs ve ps);
doMachineOp isb
od) (CALL dsb_'proc();;
(CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
(CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc())))
 2. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation ARM_H.Unify invlabel; start' = vs; end' = ve; t = ARM_H.Unify\<rbrakk> \<Longrightarrow> \<lbrace>?R1693 ps\<rbrace> doMachineOp (cleanCacheRange_PoU vs ve ps) \<lbrace>?Q1681 pstart invlabel start' end'\<rbrace>
 3. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 4. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'1700 pstart s sa sb t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'1700 pstart s sa sb t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 5. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5)) s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - ve) \<le> gsMaxObjectSize (?s1632 pstart))) s) \<and> (t = ARM_H.Unify \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5) and ?R1693 pstart) s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'1700 pstart s sa sb t rv} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
?Q'1700 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?Q'1698 (invLabel___int_' s) (start_' sa) (end_' sb)
\<lambda>invlabel t rv. ?Q'1699 invlabel rv (xfdc t) \<equiv>\<^sup>? \<lambda>invlabel. ?Q'1698 invlabel vs ve proof (prove)
goal (6 subgoals):
 1. \<And>pstart invlabel start' end' rv xfdca rva xfdcb. \<lbrakk>pstart = ps; flushtype_relation ARM_H.Unify invlabel; start' = vs; end' = ve; t = ARM_H.Unify; dc rv xfdca; dc rva xfdcb\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1734 pstart invlabel start' end' rv xfdca rva) (?Q'1755 invlabel rv xfdca rva xfdcb) [SKIP] (do rv <- doMachineOp (invalidateCacheRange_I vs ve ps);
rv <- doMachineOp (branchFlushRange vs ve ps);
doMachineOp isb
od) (CALL invalidateCacheRange_I_'proc(vs,ve,ps);;
(CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc()))
 2. \<And>pstart invlabel start' end' rv xfdc. \<lbrakk>pstart = ps; flushtype_relation ARM_H.Unify invlabel; start' = vs; end' = ve; t = ARM_H.Unify; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1751 pstart invlabel start' end' rv\<rbrace> doMachineOp dsb \<lbrace>?Q1734 pstart invlabel start' end' rv xfdc\<rbrace>
 3. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation ARM_H.Unify invlabel; start' = vs; end' = ve; t = ARM_H.Unify\<rbrakk> \<Longrightarrow> \<lbrace>?R1693 ps\<rbrace> doMachineOp (cleanCacheRange_PoU vs ve ps) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1751 pstart invlabel start' end' a\<rbrace>
 4. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 5. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'1757 pstart s sa sb t rv ta rva}} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'1757 pstart s sa sb t rv ta rva}} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 6. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5)) s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - ve) \<le> gsMaxObjectSize (?s1632 pstart))) s) \<and> (t = ARM_H.Unify \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5) and ?R1693 pstart) s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'1757 pstart s sa sb t rv ta rva}} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
?Q'1757 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?Q'1756 (invLabel___int_' s) (start_' sa) (end_' sb)
\<lambda>invlabel. ?Q'1756 invlabel vs ve \<equiv>\<^sup>? \<lambda>invlabel t rv ta rva. ?Q'1755 invlabel rv (xfdc t) rva (xfdc ta) proof (prove)
goal (7 subgoals):
 1. \<And>pstart invlabel start' end' rv xfdca rva xfdcb rvb xfdcc. \<lbrakk>pstart = ps; flushtype_relation ARM_H.Unify invlabel; start' = vs; end' = ve; t = ARM_H.Unify; dc rv xfdca; dc rva xfdcb; dc rvb xfdcc\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1792 pstart invlabel start' end' rv xfdca rva xfdcb rvb) (?Q'1814 invlabel rv xfdca rva xfdcb rvb xfdcc) [SKIP] (do rv <- doMachineOp (branchFlushRange vs ve ps);
doMachineOp isb
od) (CALL branchFlushRange_'proc(vs,ve,ps);;
CALL isb_'proc())
 2. \<And>pstart invlabel start' end' rv xfdca rva xfdc. \<lbrakk>pstart = ps; flushtype_relation ARM_H.Unify invlabel; start' = vs; end' = ve; t = ARM_H.Unify; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1809 pstart invlabel start' end' rv xfdca rva\<rbrace> doMachineOp (invalidateCacheRange_I vs ve ps) \<lbrace>?Q1792 pstart invlabel start' end' rv xfdca rva xfdc\<rbrace>
 3. \<And>pstart invlabel start' end' rv xfdc. \<lbrakk>pstart = ps; flushtype_relation ARM_H.Unify invlabel; start' = vs; end' = ve; t = ARM_H.Unify; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1751 pstart invlabel start' end' rv\<rbrace> doMachineOp dsb \<lbrace>\<lambda>a. (\<lambda>a. vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5) and ?R1809 pstart invlabel start' end' rv xfdc a\<rbrace>
 4. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation ARM_H.Unify invlabel; start' = vs; end' = ve; t = ARM_H.Unify\<rbrakk> \<Longrightarrow> \<lbrace>?R1693 ps\<rbrace> doMachineOp (cleanCacheRange_PoU vs ve ps) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1751 pstart invlabel start' end' a\<rbrace>
 5. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 6. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>tb rvb. dc rvb (xfdc tb) \<longrightarrow> s'\<lparr>globals := globals tb\<rparr> \<in> ?Q'1816 pstart s sa sb t rv ta rva tb rvb}}} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>tb rvb. dc rvb (xfdc tb) \<longrightarrow> s'\<lparr>globals := globals tb\<rparr> \<in> ?Q'1816 pstart s sa sb t rv ta rva tb rvb}}} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 7. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5)) s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - ve) \<le> gsMaxObjectSize (?s1632 pstart))) s) \<and> (t = ARM_H.Unify \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5) and ?R1693 pstart) s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>tb rvb. dc rvb (xfdc tb) \<longrightarrow> s'\<lparr>globals := globals tb\<rparr> \<in> ?Q'1816 pstart s sa sb t rv ta rva tb rvb}}} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
?Q'1816 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?Q'1815 (invLabel___int_' s) (start_' sa) (end_' sb)
\<lambda>invlabel. ?Q'1815 invlabel vs ve \<equiv>\<^sup>? \<lambda>invlabel t rv ta rva tb rvb. ?Q'1814 invlabel rv (xfdc t) rva (xfdc ta) rvb (xfdc tb) proof (prove)
goal (8 subgoals):
 1. \<And>pstart invlabel start' end' rv xfdca rva xfdcb rvb xfdcc rvc xfdcd. \<lbrakk>pstart = ps; flushtype_relation ARM_H.Unify invlabel; start' = vs; end' = ve; t = ARM_H.Unify; dc rv xfdca; dc rva xfdcb; dc rvb xfdcc; dc rvc xfdcd\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1852 pstart invlabel start' end' rv xfdca rva xfdcb rvb xfdcc rvc) (?Q'1874 invlabel rv xfdca rva xfdcb rvb xfdcc rvc xfdcd) [SKIP] (doMachineOp isb) (CALL isb_'proc())
 2. \<And>pstart invlabel start' end' rv xfdca rva xfdcb rvb xfdc. \<lbrakk>pstart = ps; flushtype_relation ARM_H.Unify invlabel; start' = vs; end' = ve; t = ARM_H.Unify; dc rv xfdca; dc rva xfdcb; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1869 pstart invlabel start' end' rv xfdca rva xfdcb rvb\<rbrace> doMachineOp (branchFlushRange vs ve ps) \<lbrace>?Q1852 pstart invlabel start' end' rv xfdca rva xfdcb rvb xfdc\<rbrace>
 3. \<And>pstart invlabel start' end' rv xfdca rva xfdc. \<lbrakk>pstart = ps; flushtype_relation ARM_H.Unify invlabel; start' = vs; end' = ve; t = ARM_H.Unify; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1809 pstart invlabel start' end' rv xfdca rva\<rbrace> doMachineOp (invalidateCacheRange_I vs ve ps) \<lbrace>\<lambda>a. (\<lambda>a. vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5) and ?R1869 pstart invlabel start' end' rv xfdca rva xfdc a\<rbrace>
 4. \<And>pstart invlabel start' end' rv xfdc. \<lbrakk>pstart = ps; flushtype_relation ARM_H.Unify invlabel; start' = vs; end' = ve; t = ARM_H.Unify; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1751 pstart invlabel start' end' rv\<rbrace> doMachineOp dsb \<lbrace>\<lambda>a. (\<lambda>a. vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5) and ?R1809 pstart invlabel start' end' rv xfdc a\<rbrace>
 5. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation ARM_H.Unify invlabel; start' = vs; end' = ve; t = ARM_H.Unify\<rbrakk> \<Longrightarrow> \<lbrace>?R1693 ps\<rbrace> doMachineOp (cleanCacheRange_PoU vs ve ps) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1751 pstart invlabel start' end' a\<rbrace>
 6. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 7. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>tb rvb. dc rvb (xfdc tb) \<longrightarrow> s'\<lparr>globals := globals tb\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>tc rvc. dc rvc (xfdc tc) \<longrightarrow> s'\<lparr>globals := globals tc\<rparr> \<in> ?Q'1876 pstart s sa sb t rv ta rva tb rvb tc rvc}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>tb rvb. dc rvb (xfdc tb) \<longrightarrow> s'\<lparr>globals := globals tb\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>tc rvc. dc rvc (xfdc tc) \<longrightarrow> s'\<lparr>globals := globals tc\<rparr> \<in> ?Q'1876 pstart s sa sb t rv ta rva tb rvb tc rvc}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 8. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5)) s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - ve) \<le> gsMaxObjectSize (?s1632 pstart))) s) \<and> (t = ARM_H.Unify \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5) and ?R1693 pstart) s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>ta rva. dc rva (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>tb rvb. dc rvb (xfdc tb) \<longrightarrow> s'\<lparr>globals := globals tb\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>tc rvc. dc rvc (xfdc tc) \<longrightarrow> s'\<lparr>globals := globals tc\<rparr> \<in> ?Q'1876 pstart s sa sb t rv ta rva tb rvb tc rvc}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace>
flex-flex pairs:
?Q'1876 ps \<equiv>\<^sup>? \<lambda>s sa sb. ?Q'1875 (invLabel___int_' s) (start_' sa) (end_' sb)
\<lambda>invlabel. ?Q'1875 invlabel vs ve \<equiv>\<^sup>? \<lambda>invlabel t rv ta rva tb rvb tc rvc. ?Q'1874 invlabel rv (xfdc t) rva (xfdc ta) rvb (xfdc tb) rvc (xfdc tc) proof (prove)
goal (7 subgoals):
 1. \<And>pstart invlabel start' end' rv xfdca rva xfdcb rvb xfdc. \<lbrakk>pstart = ps; flushtype_relation ARM_H.Unify invlabel; start' = vs; end' = ve; t = ARM_H.Unify; dc rv xfdca; dc rva xfdcb; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1869 pstart invlabel start' end' rv xfdca rva xfdcb rvb\<rbrace> doMachineOp (branchFlushRange vs ve ps) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>pstart invlabel start' end' rv xfdca rva xfdc. \<lbrakk>pstart = ps; flushtype_relation ARM_H.Unify invlabel; start' = vs; end' = ve; t = ARM_H.Unify; dc rv xfdca; dc rva xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1809 pstart invlabel start' end' rv xfdca rva\<rbrace> doMachineOp (invalidateCacheRange_I vs ve ps) \<lbrace>\<lambda>a. (\<lambda>a. vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5) and ?R1869 pstart invlabel start' end' rv xfdca rva xfdc a\<rbrace>
 3. \<And>pstart invlabel start' end' rv xfdc. \<lbrakk>pstart = ps; flushtype_relation ARM_H.Unify invlabel; start' = vs; end' = ve; t = ARM_H.Unify; dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1751 pstart invlabel start' end' rv\<rbrace> doMachineOp dsb \<lbrace>\<lambda>a. (\<lambda>a. vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5) and ?R1809 pstart invlabel start' end' rv xfdc a\<rbrace>
 4. \<And>pstart invlabel start' end'. \<lbrakk>pstart = ps; flushtype_relation ARM_H.Unify invlabel; start' = vs; end' = ve; t = ARM_H.Unify\<rbrakk> \<Longrightarrow> \<lbrace>?R1693 ps\<rbrace> doMachineOp (cleanCacheRange_PoU vs ve ps) \<lbrace>\<lambda>a. (\<lambda>a. True) and ?R1751 pstart invlabel start' end' a\<rbrace>
 5. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 6. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV}}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV}}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 7. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5)) s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - ve) \<le> gsMaxObjectSize (?s1632 pstart))) s) \<and> (t = ARM_H.Unify \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5) and ?R1693 pstart) s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV}}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace> proof (prove)
goal (3 subgoals):
 1. \<And>pstart s'. pstart = ps \<Longrightarrow> globals (globals_update (ghost'state_'_update id) s') = globals s'
 2. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV}}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV}}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 3. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5)) s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - ve) \<le> gsMaxObjectSize (?s1632 pstart))) s) \<and> (t = ARM_H.Unify \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5) and (\<lambda>a. True \<and> (vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5) \<and> (vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5) \<and> True)) s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV}}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>pstart s'. \<lbrakk>pstart = ps; s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV}}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}\<rbrakk> \<Longrightarrow> globals_update (ghost'state_'_update id) s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV}}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>}
 2. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5)) s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - ve) \<le> gsMaxObjectSize (?s1632 pstart))) s) \<and> (t = ARM_H.Unify \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5) and (\<lambda>a. True \<and> (vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5) \<and> (vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5) \<and> True)) s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV}}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>pstart s s'. \<lbrakk>pstart = ps; (s, s') \<in> rf_sr; vs \<le> ve \<and> ps \<le> ps + (ve - vs) \<and> vs && mask 5 = ps && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s; s' \<in> \<lbrace>flushtype_relation t \<acute>invLabel___int\<rbrace> \<inter> \<lbrace>\<acute>start = vs\<rbrace> \<inter> \<lbrace>\<acute>end = ve\<rbrace>\<rbrakk> \<Longrightarrow> ((t = ARM_H.Clean \<longrightarrow> vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - vs) \<le> gsMaxObjectSize s) \<and> (t = ARM_H.Invalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5)) s) \<and> (t = ARM_H.CleanInvalidate \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5 \<and> unat (ve - ve) \<le> gsMaxObjectSize (?s1632 pstart))) s) \<and> (t = ARM_H.Unify \<longrightarrow> ((\<lambda>s. unat (ve - vs) \<le> gsMaxObjectSize s) and (\<lambda>_. vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5) and (\<lambda>a. True \<and> (vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5) \<and> (vs \<le> ve \<and> pstart \<le> pstart + (ve - vs) \<and> vs && mask 5 = pstart && mask 5) \<and> True)) s)) \<and> s' \<in> {s. s \<in> {sa. sa \<in> {sb. sb \<in> {sc. t = ARM_H.Clean \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.Invalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> ({sc. t = ARM_H.CleanInvalidate \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>} \<inter> {sc. t = ARM_H.Unify \<longrightarrow> sc \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. end_' sb) (start_'_update (\<lambda>_. start_' sa) s)) \<in> \<lbrace>\<acute>start = \<^bsup>sa\<^esup>start\<rbrace> \<inter> \<lbrace>\<acute>end = \<^bsup>sb\<^esup>end\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. s \<in> UNIV}}}}} \<inter> \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageUnify_Instruction \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDUnify_Instruction\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageCleanInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDCleanInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageInvalidate_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDInvalidate_Data\<rbrace> \<inter> - \<lbrace>\<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPageClean_Data \<or> \<^bsup>s\<^esup>invLabel___int = Kernel_C.ARMPDClean_Data\<rbrace>})) \<inter> \<lbrace>\<^bsup>sb\<^esup>end = ve\<rbrace>} \<inter> \<lbrace>\<^bsup>sa\<^esup>start = vs\<rbrace>} \<inter> \<lbrace>flushtype_relation t \<^bsup>s\<^esup>invLabel___int\<rbrace>} \<inter> \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> \<acute>end - \<acute>start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> \<acute>start \<le> \<acute>end\<rbrace> proof (prove)
goal:
No subgoals!