theory Arch_C

lemma createSafeMappingEntries_PDE_ccorres:
  "ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv')
                                         \<and> pde_range_relation (snd (theRight rv)) (snd rv')))
     (liftxf errstate create_mappings_pde_return_C.status_C
             (\<lambda>v. (create_mappings_pde_return_C.pde_C v,
                   create_mappings_pde_return_C.pde_entries_C v))
             ret__struct_create_mappings_pde_return_C_')
     (page_directory_at' pd and (\<lambda>_. vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz
                        \<and> is_aligned pd pdBits))
     (UNIV \<inter> {s. base_' s = base} \<inter> {s. vaddr_' s = vaddr}
           \<inter> {s. frameSize_' s = framesize_from_H vsz
                   \<and> (vsz = ARMSection \<or> vsz = ARMSuperSection)}
           \<inter> {s. vmrights_to_H (vmRights_' s) = vrights \<and> vmRights_' s < 4}
           \<inter> {s. vm_attribs_relation attr (attr_' s)}
           \<inter> {s. pd_' s = pde_Ptr pd}) []
     (createSafeMappingEntries base vaddr vsz vrights attr pd)
     (Call createSafeMappingEntries_PDE_'proc)" apply (rule ccorres_gen_asm) apply (subgoal_tac "vsz = ARMSuperSection
                       \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C") prefer 2 apply (clarsimp simp: vmsz_aligned'_def) apply (rule is_aligned_no_wrap'[where sz=6], simp_all add: word_bits_def)[1] apply (simp add: lookup_pd_slot_def Let_def) apply (erule aligned_add_aligned,
          simp_all add: pdBits_def pageBits_def word_bits_def)[1] apply (intro is_aligned_shiftl is_aligned_shiftr) apply simp apply (cinit lift: base_' vaddr_' frameSize_' vmRights_' attr_' pd_') apply (simp add: createSafeMappingEntries_def createMappingEntries_def
                    ensureSafeMapping_def framesize_from_H_eqs
               del: Collect_const) apply (rule ccorres_Cond_rhs) apply (simp add: mapME_x_def sequenceE_x_def bindE_assoc
                del: Collect_const) apply (simp add: liftE_bindE) apply (rule ccorres_pre_getObject_pde) apply (rule_tac P'="{s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddr)) = Some v
                                 \<and> cpde_relation x v
                                 \<and> array_assertion (pde_Ptr pd) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}"
               in ccorres_from_vcg_might_throw[where P=\<top>]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: if_1_0_0) apply (clarsimp simp: typ_heap_simps vm_attribs_relation_def
                          from_bool_mask_simp[unfolded mask_def, simplified]) apply (rule conjI) apply (simp add: gen_framesize_to_H_def vm_page_size_defs) apply (clarsimp simp: pde_get_tag_alt cpde_relation_pde_case
                          pde_tag_defs fst_throwError_returnOk
                          pde_range_relation_def ptr_range_to_list_def
                          exception_defs isRight_def
                          syscall_error_rel_def syscall_error_to_H_cases) apply (clarsimp simp: cpde_relation_def) apply (rule ccorres_Cond_rhs) apply (simp del: Collect_const) apply (rule ccorres_rhs_assoc)+ apply (rule ccorres_rhs_assoc2) apply (rule ccorres_symb_exec_r) apply (rule ccorres_Guard_Seq)+ apply csymbr apply csymbr apply csymbr apply csymbr apply csymbr apply (simp add: mapME_x_sequenceE bindE_assoc) apply (simp add:ARMSuperSectionBits_def word_0_sle_from_less
         ARMSectionBits_def) apply (ccorres_remove_UNIV_guard) apply csymbr apply (rule ccorres_rhs_assoc2,rule ccorres_splitE) apply (simp only:whileAnno_def) apply (ccorres_remove_UNIV_guard) apply (rule_tac r'=dc and xf'=xfdc and F="\<lambda>_. page_directory_at' pd"
                    and Q="{s. pde_range_C.base_C (pde_entries_C
                                                   ret___struct_create_mappings_pde_return_C)
                                   = Ptr (lookup_pd_slot pd vaddr)}"
                     in ccorres_sequenceE_while) apply (simp add: liftE_bindE) apply (rule ccorres_guard_imp2) apply (rule_tac r'="\<lambda>rv rv'. rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)"
                           and xf'=ret__int_' in ccorres_split_nothrow_novcg) apply (rule ccorres_add_return2, rule ccorres_pre_getObject_pde) apply (rule_tac P'="{s. let ptr = (pde_range_C.base_C (pde_entries_C
                                                       ret___struct_create_mappings_pde_return_C))
                                  in \<exists>v. cslift s (CTypesDefs.ptr_add ptr (uint (i_' s))) = Some v
                                   \<and> cpde_relation x v
                                   \<and> (i_' s = 0 \<or> array_assertion ptr (Suc (unat (i_' s)))
                                      (hrs_htd (t_hrs_' (globals s))))}"
                             in ccorres_from_vcg_nofail[where P=\<top>]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: if_1_0_0 return_def typ_heap_simps Let_def) apply (simp add: isPageTablePDE_def isSectionPDE_def
                                     cpde_relation_pde_case) apply (intro impI conjI disjCI2, simp_all add: array_assertion_shrink_right)[1] apply (clarsimp simp: pde_tag_defs  split: if_split bool.split) apply (frule pde_pde_section_size_0_1[simplified pde_tag_defs, simplified], simp) apply ceqv apply (simp add: from_bool_0 del: Collect_const) apply (rule ccorres_from_vcg_might_throw[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: isPageTablePDE_def isSectionPDE_def
                                        fst_throwError_returnOk
                                 split: ARM_H.pde.split) apply (auto simp: exception_defs syscall_error_rel_def
                                    syscall_error_to_H_cases)[1] apply wpsimp apply (simp add: guard_is_UNIV_def) apply (clarsimp simp: upto_enum_step_def superSectionPDEOffsets_def pdeBits_def) apply (frule_tac n3="Suc o unat o i_'" in array_assertion_abs_pde_16_const[where pd=pd and vptr=vaddr,
                   simplified imp_conjL, THEN spec, THEN spec, THEN mp]) apply (subst add.commute) apply (simp add: upto_enum_word unat_of_nat vmsz_aligned_def
                                vmsz_aligned'_def
                           split: if_split_asm) apply (clarsimp simp: upto_enum_step_def upto_enum_word
                                    superSectionPDEOffsets_def pdeBits_def
                             split: if_split) apply simp apply (rule conseqPre, vcg) apply (clarsimp simp: if_1_0_0) apply simp apply (wp getPDE_wp | wpc)+ apply simp apply (simp add: upto_enum_step_def word_bits_def
                            superSectionPDEOffsets_def pdeBits_def
                       split: if_split) apply clarsimp apply ceqv apply csymbr apply (rule ccorres_return_CE, simp+)[1] apply wp apply (simp add: ccHoarePost_def isRight_def xfdc_def) apply (rule HoarePartial.SeqSwap) apply (rule_tac Q="\<lbrace>Bonus \<acute>i \<longrightarrow> Prop \<acute>ret___struct_create_mappings_pde_return_C\<rbrace>"
                   and I="\<lbrace>Prop \<acute>ret___struct_create_mappings_pde_return_C\<rbrace>"
                 for Bonus Prop
                 in HoarePartial.reannotateWhileNoGuard) apply (rule HoarePartial.While[OF order_refl]) apply (rule conseqPre, vcg) apply (clarsimp simp: if_1_0_0) apply clarsimp apply vcg apply (clarsimp simp: pde_range_relation_def) apply vcg apply (rule conseqPre, vcg, clarsimp) apply (rule ccorres_inst[where P=\<top> and P'=UNIV]) apply simp apply (clarsimp simp: vmsz_aligned'_def gen_framesize_to_H_def vm_page_size_defs
                        vm_attribs_relation_def
                        superSectionPDEOffsets_def pdeBits_def
                        from_bool_mask_simp[unfolded mask_def, simplified]
                        ptr_range_to_list_def upto_enum_step_def upto_enum_word
                  cong: if_cong) apply (frule(1) page_directory_at_rf_sr, clarsimp) apply (frule array_ptr_valid_array_assertionD[OF h_t_valid_clift]) apply (clarsimp simp:ARMSuperSectionBits_def
    ARMSectionBits_def word_0_sle_from_less
    pageBits_def) apply (rule conjI) apply (simp add: cpde_relation_def) apply (simp add: upt_def split: if_split) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (page_directory_at' pd and (\<lambda>_. vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits)) (UNIV \<inter> \<lbrace>\<acute>base = base\<rbrace> \<inter> \<lbrace>\<acute>vaddr = vaddr\<rbrace> \<inter> \<lbrace>\<acute>frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection)\<rbrace> \<inter> \<lbrace>vmrights_to_H \<acute>vmRights = vrights \<and> \<acute>vmRights < 4\<rbrace> \<inter> \<lbrace>vm_attribs_relation attr \<acute>attr\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr pd\<rbrace>) [] (createSafeMappingEntries base vaddr vsz vrights attr pd) (Call createSafeMappingEntries_PDE_'proc) proof (prove)
goal (1 subgoal):
 1. vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (page_directory_at' pd) (UNIV \<inter> \<lbrace>\<acute>base = base\<rbrace> \<inter> \<lbrace>\<acute>vaddr = vaddr\<rbrace> \<inter> \<lbrace>\<acute>frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection)\<rbrace> \<inter> \<lbrace>vmrights_to_H \<acute>vmRights = vrights \<and> \<acute>vmRights < 4\<rbrace> \<inter> \<lbrace>vm_attribs_relation attr \<acute>attr\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr pd\<rbrace>) [] (createSafeMappingEntries base vaddr vsz vrights attr pd) (Call createSafeMappingEntries_PDE_'proc) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (page_directory_at' pd) (UNIV \<inter> \<lbrace>\<acute>base = base\<rbrace> \<inter> \<lbrace>\<acute>vaddr = vaddr\<rbrace> \<inter> \<lbrace>\<acute>frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection)\<rbrace> \<inter> \<lbrace>vmrights_to_H \<acute>vmRights = vrights \<and> \<acute>vmRights < 4\<rbrace> \<inter> \<lbrace>vm_attribs_relation attr \<acute>attr\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr pd\<rbrace>) [] (createSafeMappingEntries base vaddr vsz vrights attr pd) (Call createSafeMappingEntries_PDE_'proc)
 2. vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits \<Longrightarrow> vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C proof (prove)
goal (2 subgoals):
 1. vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits \<Longrightarrow> vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C
 2. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (page_directory_at' pd) (UNIV \<inter> \<lbrace>\<acute>base = base\<rbrace> \<inter> \<lbrace>\<acute>vaddr = vaddr\<rbrace> \<inter> \<lbrace>\<acute>frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection)\<rbrace> \<inter> \<lbrace>vmrights_to_H \<acute>vmRights = vrights \<and> \<acute>vmRights < 4\<rbrace> \<inter> \<lbrace>vm_attribs_relation attr \<acute>attr\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr pd\<rbrace>) [] (createSafeMappingEntries base vaddr vsz vrights attr pd) (Call createSafeMappingEntries_PDE_'proc) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>is_aligned vaddr 24; is_aligned base 24; is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C
 2. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (page_directory_at' pd) (UNIV \<inter> \<lbrace>\<acute>base = base\<rbrace> \<inter> \<lbrace>\<acute>vaddr = vaddr\<rbrace> \<inter> \<lbrace>\<acute>frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection)\<rbrace> \<inter> \<lbrace>vmrights_to_H \<acute>vmRights = vrights \<and> \<acute>vmRights < 4\<rbrace> \<inter> \<lbrace>vm_attribs_relation attr \<acute>attr\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr pd\<rbrace>) [] (createSafeMappingEntries base vaddr vsz vrights attr pd) (Call createSafeMappingEntries_PDE_'proc) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>is_aligned vaddr 24; is_aligned base 24; is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> is_aligned (lookup_pd_slot pd vaddr) 6
 2. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (page_directory_at' pd) (UNIV \<inter> \<lbrace>\<acute>base = base\<rbrace> \<inter> \<lbrace>\<acute>vaddr = vaddr\<rbrace> \<inter> \<lbrace>\<acute>frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection)\<rbrace> \<inter> \<lbrace>vmrights_to_H \<acute>vmRights = vrights \<and> \<acute>vmRights < 4\<rbrace> \<inter> \<lbrace>vm_attribs_relation attr \<acute>attr\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr pd\<rbrace>) [] (createSafeMappingEntries base vaddr vsz vrights attr pd) (Call createSafeMappingEntries_PDE_'proc) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>is_aligned vaddr 24; is_aligned base 24; is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> is_aligned (pd + (vaddr >> 20 << 2)) 6
 2. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (page_directory_at' pd) (UNIV \<inter> \<lbrace>\<acute>base = base\<rbrace> \<inter> \<lbrace>\<acute>vaddr = vaddr\<rbrace> \<inter> \<lbrace>\<acute>frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection)\<rbrace> \<inter> \<lbrace>vmrights_to_H \<acute>vmRights = vrights \<and> \<acute>vmRights < 4\<rbrace> \<inter> \<lbrace>vm_attribs_relation attr \<acute>attr\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr pd\<rbrace>) [] (createSafeMappingEntries base vaddr vsz vrights attr pd) (Call createSafeMappingEntries_PDE_'proc) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>is_aligned vaddr 24; is_aligned base 24; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> is_aligned (vaddr >> 20 << 2) 6
 2. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (page_directory_at' pd) (UNIV \<inter> \<lbrace>\<acute>base = base\<rbrace> \<inter> \<lbrace>\<acute>vaddr = vaddr\<rbrace> \<inter> \<lbrace>\<acute>frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection)\<rbrace> \<inter> \<lbrace>vmrights_to_H \<acute>vmRights = vrights \<and> \<acute>vmRights < 4\<rbrace> \<inter> \<lbrace>vm_attribs_relation attr \<acute>attr\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr pd\<rbrace>) [] (createSafeMappingEntries base vaddr vsz vrights attr pd) (Call createSafeMappingEntries_PDE_'proc) proof (prove)
goal (2 subgoals):
 1. \<lbrakk>is_aligned vaddr 24; is_aligned base 24; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> is_aligned vaddr (6 - 2 + 20)
 2. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (page_directory_at' pd) (UNIV \<inter> \<lbrace>\<acute>base = base\<rbrace> \<inter> \<lbrace>\<acute>vaddr = vaddr\<rbrace> \<inter> \<lbrace>\<acute>frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection)\<rbrace> \<inter> \<lbrace>vmrights_to_H \<acute>vmRights = vrights \<and> \<acute>vmRights < 4\<rbrace> \<inter> \<lbrace>vm_attribs_relation attr \<acute>attr\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr pd\<rbrace>) [] (createSafeMappingEntries base vaddr vsz vrights attr pd) (Call createSafeMappingEntries_PDE_'proc) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (page_directory_at' pd) (UNIV \<inter> \<lbrace>\<acute>base = base\<rbrace> \<inter> \<lbrace>\<acute>vaddr = vaddr\<rbrace> \<inter> \<lbrace>\<acute>frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection)\<rbrace> \<inter> \<lbrace>vmrights_to_H \<acute>vmRights = vrights \<and> \<acute>vmRights < 4\<rbrace> \<inter> \<lbrace>vm_attribs_relation attr \<acute>attr\<rbrace> \<inter> \<lbrace>\<acute>pd = pde_Ptr pd\<rbrace>) [] (createSafeMappingEntries base vaddr vsz vrights attr pd) (Call createSafeMappingEntries_PDE_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>pda attra vmRights frameSize vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q7467 pda attra vmRights frameSize vaddra basea) (?Q'7467 pda attra vmRights frameSize vaddra basea) [SKIP] (createSafeMappingEntries base vaddr vsz vrights attr pd) (IF frameSize = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection THEN
  \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pda,vaddra);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 1) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,basea,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_3,SCAST(32 signed \<rightarrow> 32) 0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
ELSE
  IF frameSize = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection THEN
  \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pda,vaddra);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C)));;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,basea,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_3,SCAST(32 signed \<rightarrow> 32) 0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI)
 2. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q7467 pda attra vmRights frameSize vaddra basea s \<and> s' \<in> ?Q'7467 pda attra vmRights frameSize vaddra basea proof (prove)
goal (2 subgoals):
 1. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q7467 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?Q'7467 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (IF vsz = Wellformed_C.ARMSection THEN
  \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 1) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
ELSE
  IF vsz = Wellformed_C.ARMSuperSection THEN
  \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C)));;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
ELSE
  Guard DontReach {} SKIP
FI
FI)
 2. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q7467 pda attra vmRights frameSize vaddra basea s \<and> s' \<in> ?Q'7467 pda attra vmRights frameSize vaddra basea proof (prove)
goal (3 subgoals):
 1. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q7488 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?S7491 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (\<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 1) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_')
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7487 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7489 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (IF vsz = Wellformed_C.ARMSuperSection THEN
  \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C)));;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> ?Q7488 pda attra vmRights frameSize vaddra basea s) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> ?R7487 pda attra vmRights frameSize vaddra basea s)) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> ?S7491 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> ?T7489 pda attra vmRights frameSize vaddra basea)} proof (prove)
goal (3 subgoals):
 1. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSection \<and> vmsz_aligned' base Wellformed_C.ARMSection \<and> is_aligned pd pdBits; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q7488 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSection) vaddr base) (?S7491 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSection) vaddr base) [SKIP] (doE x <- liftE (getObject (lookup_pd_slot pd vaddr));
y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [lookup_pd_slot pd vaddr]))
odE) (\<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 1) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_')
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7487 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7489 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (IF vsz = Wellformed_C.ARMSuperSection THEN
  \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C)));;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> ?Q7488 pda attra vmRights frameSize vaddra basea s) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> ?R7487 pda attra vmRights frameSize vaddra basea s)) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> ?S7491 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> ?T7489 pda attra vmRights frameSize vaddra basea)} proof (prove)
goal (3 subgoals):
 1. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSection \<and> vmsz_aligned' base Wellformed_C.ARMSection \<and> is_aligned pd pdBits; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q7488 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSection) vaddr base) (?S7491 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSection) vaddr base) [SKIP] (do x <- getObject (lookup_pd_slot pd vaddr);
doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [lookup_pd_slot pd vaddr]))
odE
od) (\<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 1) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_')
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7487 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7489 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (IF vsz = Wellformed_C.ARMSuperSection THEN
  \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C)));;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> ?Q7488 pda attra vmRights frameSize vaddra basea s) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> ?R7487 pda attra vmRights frameSize vaddra basea s)) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> ?S7491 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> ?T7489 pda attra vmRights frameSize vaddra basea)} proof (prove)
goal (3 subgoals):
 1. \<And>pda attra vmRights vaddra basea x. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSection \<and> vmsz_aligned' base Wellformed_C.ARMSection \<and> is_aligned pd pdBits; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (\<lambda>a. ?P7510 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSection) vaddr base a x) (?P'7511 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSection) vaddr base x) [SKIP] (doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [lookup_pd_slot pd vaddr]))
odE) (\<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 1) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_')
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7487 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7489 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (IF vsz = Wellformed_C.ARMSuperSection THEN
  \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C)));;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> ?P7510 pda attra vmRights frameSize vaddra basea s pde)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> ?R7487 pda attra vmRights frameSize vaddra basea s)) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> ?P'7511 pda attra vmRights frameSize vaddra basea pde}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> ?T7489 pda attra vmRights frameSize vaddra basea)} proof (prove)
goal (3 subgoals):
 1. \<And>pda attra vmRights vaddra basea x. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSection \<and> vmsz_aligned' base Wellformed_C.ARMSection \<and> is_aligned pd pdBits; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSection\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddr)) = Some v \<and> cpde_relation x v \<and> array_assertion (pde_Ptr pd) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))} \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 1) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 0 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_' {s. \<exists>(rv, \<sigma>')\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [lookup_pd_slot pd vaddr]))
odE) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' s)},{s. \<exists>(rv, \<sigma>')\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [lookup_pd_slot pd vaddr]))
odE) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' s)}
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7487 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7489 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (IF vsz = Wellformed_C.ARMSuperSection THEN
  \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C)));;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> ?R7487 pda attra vmRights frameSize vaddra basea s)) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> ?T7489 pda attra vmRights frameSize vaddra basea)} proof (prove)
goal (3 subgoals):
 1. \<And>pda attra vmRights vaddra basea x \<sigma>. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSection \<and> vmsz_aligned' base Wellformed_C.ARMSection \<and> is_aligned pd pdBits; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSection\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddr)) = Some v \<and> cpde_relation x v \<and> array_assertion (pde_Ptr pd) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))} \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. array_assertion (pde_Ptr pd) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s))) \<and> (\<forall>t. ret__ptr_to_struct_pde_C_' t = pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr) \<longrightarrow> (\<forall>t. ret__unsigned_' t = armParityEnabled_CL (vm_attributes_lift attra) \<longrightarrow> (\<forall>t. ret__unsigned_' t = armPageCacheable_CL (vm_attributes_lift attra) \<longrightarrow> (\<forall>t. ret__unsigned_' t = armExecuteNever_CL (vm_attributes_lift attra) \<longrightarrow> vmRights < 4 \<and> vmsz_aligned' base (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection)) \<and> armParityEnabled_CL (vm_attributes_lift attra) && 1 = armParityEnabled_CL (vm_attributes_lift attra) \<and> 0 && 0xF = 0 \<and> armPageCacheable_CL (vm_attributes_lift attra) && 1 = armPageCacheable_CL (vm_attributes_lift attra) \<and> armExecuteNever_CL (vm_attributes_lift attra) && 1 = armExecuteNever_CL (vm_attributes_lift attra) \<and> (\<forall>t. pde_lift (ret__struct_pde_C_' t) = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if True then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>) \<longrightarrow> s \<Turnstile>\<^sub>c pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))) \<and> (\<forall>ta. ret__unsigned_' ta = pde_get_tag (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))))))) \<longrightarrow> ((if UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))) \<noteq> pde_pde_invalid then 1 else 0) \<noteq> 0 \<longrightarrow> ((if UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))) \<noteq> pde_pde_section then 1 else 0) \<noteq> 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [lookup_pd_slot pd vaddr]))
odE) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) (current_syscall_error_' (globals s)))) (s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr), unsigned_eret_2_' := armPageCacheable_CL (vm_attributes_lift attra), unsigned_eret_3_' := armExecuteNever_CL (vm_attributes_lift attra), ret__struct_pde_C_' := ret__struct_pde_C_' t, ret__unsigned_' := pde_get_tag (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))))))), currentPDEType_' := UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))), ret__int_' := if UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))) \<noteq> pde_pde_section then 1 else 0\<rparr>)\<lparr>ret___struct_create_mappings_pde_return_C_' := create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))), ret__struct_create_mappings_pde_return_C_' := create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) (current_syscall_error_' (globals s)))) (s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr), unsigned_eret_2_' := armPageCacheable_CL (vm_attributes_lift attra), unsigned_eret_3_' := armExecuteNever_CL (vm_attributes_lift attra), ret__struct_pde_C_' := ret__struct_pde_C_' t, ret__unsigned_' := pde_get_tag (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))))))), currentPDEType_' := UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))), ret__int_' := if UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))) \<noteq> pde_pde_section then 1 else 0\<rparr>)\<lparr>ret___struct_create_mappings_pde_return_C_' := create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))), ret__struct_create_mappings_pde_return_C_' := create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))), global_exn_var_' := Return\<rparr>)))) \<and> ((if UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))) \<noteq> pde_pde_section then 1 else 0) = 0 \<longrightarrow> s \<Turnstile>\<^sub>c pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))) \<and> pde_get_tag (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))))))) = SCAST(32 signed \<rightarrow> 32) pde_pde_section \<and> (\<forall>ta. ret__unsigned_' ta = size_CL (pde_pde_section_lift (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))) \<longrightarrow> ((if size_CL (pde_pde_section_lift (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [lookup_pd_slot pd vaddr]))
odE) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) (current_syscall_error_' (globals s)))) (s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr), unsigned_eret_2_' := armPageCacheable_CL (vm_attributes_lift attra), unsigned_eret_3_' := armExecuteNever_CL (vm_attributes_lift attra), ret__struct_pde_C_' := ret__struct_pde_C_' t, currentPDEType_' := UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))), ret__unsigned_' := size_CL (pde_pde_section_lift (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))), ret__int_' := if size_CL (pde_pde_section_lift (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))) \<noteq> 0 then 1 else 0\<rparr>)\<lparr>ret___struct_create_mappings_pde_return_C_' := create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))), ret__struct_create_mappings_pde_return_C_' := create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) (current_syscall_error_' (globals s)))) (s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr), unsigned_eret_2_' := armPageCacheable_CL (vm_attributes_lift attra), unsigned_eret_3_' := armExecuteNever_CL (vm_attributes_lift attra), ret__struct_pde_C_' := ret__struct_pde_C_' t, currentPDEType_' := UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))), ret__unsigned_' := size_CL (pde_pde_section_lift (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))), ret__int_' := if size_CL (pde_pde_section_lift (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))) \<noteq> 0 then 1 else 0\<rparr>)\<lparr>ret___struct_create_mappings_pde_return_C_' := create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))), ret__struct_create_mappings_pde_return_C_' := create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))), global_exn_var_' := Return\<rparr>)))) \<and> ((if size_CL (pde_pde_section_lift (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))) \<noteq> 0 then 1 else 0) = 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [lookup_pd_slot pd vaddr]))
odE) \<sigma>). (\<sigma>', s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr), unsigned_eret_2_' := armPageCacheable_CL (vm_attributes_lift attra), unsigned_eret_3_' := armExecuteNever_CL (vm_attributes_lift attra), ret__struct_pde_C_' := ret__struct_pde_C_' t, currentPDEType_' := UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))), ret__unsigned_' := size_CL (pde_pde_section_lift (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))), ret__int_' := 0, ret___struct_create_mappings_pde_return_C_' := create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))), ret__struct_create_mappings_pde_return_C_' := create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' (s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr), unsigned_eret_2_' := armPageCacheable_CL (vm_attributes_lift attra), unsigned_eret_3_' := armExecuteNever_CL (vm_attributes_lift attra), ret__struct_pde_C_' := ret__struct_pde_C_' t, currentPDEType_' := UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))), ret__unsigned_' := size_CL (pde_pde_section_lift (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))), ret__int_' := 0, ret___struct_create_mappings_pde_return_C_' := create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))), ret__struct_create_mappings_pde_return_C_' := create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))), global_exn_var_' := Return\<rparr>))))))) \<and> ((if UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))) \<noteq> pde_pde_invalid then 1 else 0) = 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [lookup_pd_slot pd vaddr]))
odE) \<sigma>). (\<sigma>', s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr), unsigned_eret_2_' := armPageCacheable_CL (vm_attributes_lift attra), unsigned_eret_3_' := armExecuteNever_CL (vm_attributes_lift attra), ret__struct_pde_C_' := ret__struct_pde_C_' t, ret__unsigned_' := pde_get_tag (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))))))), currentPDEType_' := UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))), ret__int_' := 0, ret___struct_create_mappings_pde_return_C_' := create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))), ret__struct_create_mappings_pde_return_C_' := create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' (s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr), unsigned_eret_2_' := armPageCacheable_CL (vm_attributes_lift attra), unsigned_eret_3_' := armExecuteNever_CL (vm_attributes_lift attra), ret__struct_pde_C_' := ret__struct_pde_C_' t, ret__unsigned_' := pde_get_tag (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))))))), currentPDEType_' := UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (the (cslift s (pde_range_C.base_C (pde_entries_C (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))))))))), ret__int_' := 0, ret___struct_create_mappings_pde_return_C_' := create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))), ret__struct_create_mappings_pde_return_C_' := create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1)) (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))), global_exn_var_' := Return\<rparr>))))))))))}
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7487 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7489 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (IF vsz = Wellformed_C.ARMSuperSection THEN
  \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C)));;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> ?R7487 pda attra vmRights frameSize vaddra basea s)) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> ?T7489 pda attra vmRights frameSize vaddra basea)} proof (prove)
goal (3 subgoals):
 1. \<And>attra vmRights x \<sigma> xa v t ta tb tc. \<lbrakk>vm_attribs_relation attr attra; vsz = Wellformed_C.ARMSection; vmsz_aligned' vaddr Wellformed_C.ARMSection; vmRights < 4; vrights = vmrights_to_H vmRights; (\<sigma>, xa) \<in> rf_sr; vmsz_aligned' base Wellformed_C.ARMSection; is_aligned pd pdBits; cslift xa (pde_Ptr (lookup_pd_slot pd vaddr)) = Some v; cpde_relation x v; array_assertion (pde_Ptr pd) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals xa))); ret__ptr_to_struct_pde_C_' t = pde_Ptr (lookup_pd_slot pd vaddr); ret__unsigned_' ta = armParityEnabled_CL (vm_attributes_lift attra); ret__unsigned_' tb = armPageCacheable_CL (vm_attributes_lift attra); ret__unsigned_' tc = armExecuteNever_CL (vm_attributes_lift attra)\<rbrakk> \<Longrightarrow> vmsz_aligned' base (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection)) \<and> armParityEnabled_CL (vm_attributes_lift attra) && 1 = armParityEnabled_CL (vm_attributes_lift attra) \<and> armPageCacheable_CL (vm_attributes_lift attra) && 1 = armPageCacheable_CL (vm_attributes_lift attra) \<and> armExecuteNever_CL (vm_attributes_lift attra) && 1 = armExecuteNever_CL (vm_attributes_lift attra) \<and> (\<forall>t. pde_lift (ret__struct_pde_C_' t) = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = 0, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>) \<longrightarrow> xa \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pd vaddr) \<and> ((\<exists>t. ret__unsigned_' t = pde_get_tag v) \<longrightarrow> (pde_get_tag v \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (pde_get_tag v \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> (\<exists>x\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights), [lookup_pd_slot pd vaddr]))
odE) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) (current_syscall_error_' (globals xa)))) (xa\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookup_pd_slot pd vaddr), unsigned_eret_2_' := armPageCacheable_CL (vm_attributes_lift attra), unsigned_eret_3_' := armExecuteNever_CL (vm_attributes_lift attra), ret__struct_pde_C_' := ret__struct_pde_C_' t, ret__unsigned_' := pde_get_tag v, currentPDEType_' := UCAST(32 \<rightarrow> 32 signed) (pde_get_tag v), ret__int_' := 1\<rparr>)\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (ret___struct_create_mappings_pde_return_C_' xa))), ret__struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (ret___struct_create_mappings_pde_return_C_' xa))), global_exn_var_' := Return\<rparr>)))) \<and> (pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> xa \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pd vaddr) \<and> ((\<exists>t. ret__unsigned_' t = size_CL (pde_pde_section_lift v)) \<longrightarrow> (size_CL (pde_pde_section_lift v) \<noteq> 0 \<longrightarrow> (\<exists>x\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights), [lookup_pd_slot pd vaddr]))
odE) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) (current_syscall_error_' (globals xa)))) (xa\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookup_pd_slot pd vaddr), unsigned_eret_2_' := armPageCacheable_CL (vm_attributes_lift attra), unsigned_eret_3_' := armExecuteNever_CL (vm_attributes_lift attra), ret__struct_pde_C_' := ret__struct_pde_C_' t, currentPDEType_' := pde_pde_section, ret__unsigned_' := size_CL (pde_pde_section_lift v), ret__int_' := 1\<rparr>)\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (ret___struct_create_mappings_pde_return_C_' xa))), ret__struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (ret___struct_create_mappings_pde_return_C_' xa))), global_exn_var_' := Return\<rparr>)))) \<and> (size_CL (pde_pde_section_lift v) = 0 \<longrightarrow> (\<exists>x\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights), [lookup_pd_slot pd vaddr]))
odE) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' (xa\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookup_pd_slot pd vaddr), unsigned_eret_2_' := armPageCacheable_CL (vm_attributes_lift attra), unsigned_eret_3_' := armExecuteNever_CL (vm_attributes_lift attra), ret__struct_pde_C_' := ret__struct_pde_C_' t, currentPDEType_' := pde_pde_section, ret__unsigned_' := 0, ret__int_' := 0, ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_create_mappings_pde_return_C_' xa))), ret__struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_create_mappings_pde_return_C_' xa))), global_exn_var_' := Return\<rparr>))))))) \<and> (pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (\<exists>x\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights), [lookup_pd_slot pd vaddr]))
odE) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' (xa\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookup_pd_slot pd vaddr), unsigned_eret_2_' := armPageCacheable_CL (vm_attributes_lift attra), unsigned_eret_3_' := armExecuteNever_CL (vm_attributes_lift attra), ret__struct_pde_C_' := ret__struct_pde_C_' t, ret__unsigned_' := SCAST(32 signed \<rightarrow> 32) pde_pde_invalid, currentPDEType_' := pde_pde_invalid, ret__int_' := 0, ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_create_mappings_pde_return_C_' xa))), ret__struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_create_mappings_pde_return_C_' xa))), global_exn_var_' := Return\<rparr>))))))
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7487 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7489 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (IF vsz = Wellformed_C.ARMSuperSection THEN
  \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C)));;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> ?R7487 pda attra vmRights frameSize vaddra basea s)) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> ?T7489 pda attra vmRights frameSize vaddra basea)} proof (prove)
goal (3 subgoals):
 1. \<And>attra vmRights x \<sigma> xa v t ta tb tc. \<lbrakk>vsz = Wellformed_C.ARMSection; vmsz_aligned' vaddr Wellformed_C.ARMSection; vmRights < 4; vrights = vmrights_to_H vmRights; (\<sigma>, xa) \<in> rf_sr; vmsz_aligned' base Wellformed_C.ARMSection; is_aligned pd pdBits; cslift xa (pde_Ptr (lookup_pd_slot pd vaddr)) = Some v; cpde_relation x v; array_assertion (pde_Ptr pd) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals xa))); ret__ptr_to_struct_pde_C_' t = pde_Ptr (lookup_pd_slot pd vaddr); ret__unsigned_' ta = from_bool (armParityEnabled attr); ret__unsigned_' tb = from_bool (armPageCacheable attr); ret__unsigned_' tc = from_bool (armExecuteNever attr); armParityEnabled_CL (vm_attributes_lift attra) = from_bool (armParityEnabled attr); armPageCacheable_CL (vm_attributes_lift attra) = from_bool (armPageCacheable attr); armExecuteNever_CL (vm_attributes_lift attra) = from_bool (armExecuteNever attr)\<rbrakk> \<Longrightarrow> vmsz_aligned' base (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection)) \<and> (\<forall>t. pde_lift (ret__struct_pde_C_' t) = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = 0, nG_CL = 1, S_CL = s_from_cacheable (armPageCacheable attr), APX_CL = 0, TEX_CL = tex_from_cacheable (armPageCacheable attr), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = from_bool (armParityEnabled attr), Domain_CL = 0, XN_CL = from_bool (armExecuteNever attr), C_CL = 0, B_CL = b_from_cacheable (armPageCacheable attr)\<rparr>) \<longrightarrow> (\<exists>t. ret__unsigned_' t = pde_get_tag v) \<longrightarrow> (pde_get_tag v \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (pde_get_tag v \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> (\<exists>x\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights), [lookup_pd_slot pd vaddr]))
odE) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) (current_syscall_error_' (globals xa)))) (xa\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookup_pd_slot pd vaddr), unsigned_eret_2_' := from_bool (armPageCacheable attr), unsigned_eret_3_' := from_bool (armExecuteNever attr), ret__struct_pde_C_' := ret__struct_pde_C_' t, ret__unsigned_' := pde_get_tag v, currentPDEType_' := UCAST(32 \<rightarrow> 32 signed) (pde_get_tag v), ret__int_' := 1\<rparr>)\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (ret___struct_create_mappings_pde_return_C_' xa))), ret__struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (ret___struct_create_mappings_pde_return_C_' xa))), global_exn_var_' := Return\<rparr>)))) \<and> (pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> (\<exists>t. ret__unsigned_' t = size_CL (pde_pde_section_lift v)) \<longrightarrow> (size_CL (pde_pde_section_lift v) \<noteq> 0 \<longrightarrow> (\<exists>x\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights), [lookup_pd_slot pd vaddr]))
odE) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) (current_syscall_error_' (globals xa)))) (xa\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookup_pd_slot pd vaddr), unsigned_eret_2_' := from_bool (armPageCacheable attr), unsigned_eret_3_' := from_bool (armExecuteNever attr), ret__struct_pde_C_' := ret__struct_pde_C_' t, currentPDEType_' := pde_pde_section, ret__unsigned_' := size_CL (pde_pde_section_lift v), ret__int_' := 1\<rparr>)\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (ret___struct_create_mappings_pde_return_C_' xa))), ret__struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (ret___struct_create_mappings_pde_return_C_' xa))), global_exn_var_' := Return\<rparr>)))) \<and> (size_CL (pde_pde_section_lift v) = 0 \<longrightarrow> (\<exists>x\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights), [lookup_pd_slot pd vaddr]))
odE) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' (xa\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookup_pd_slot pd vaddr), unsigned_eret_2_' := from_bool (armPageCacheable attr), unsigned_eret_3_' := from_bool (armExecuteNever attr), ret__struct_pde_C_' := ret__struct_pde_C_' t, currentPDEType_' := pde_pde_section, ret__unsigned_' := 0, ret__int_' := 0, ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_create_mappings_pde_return_C_' xa))), ret__struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_create_mappings_pde_return_C_' xa))), global_exn_var_' := Return\<rparr>)))))) \<and> (pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (\<exists>x\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights), [lookup_pd_slot pd vaddr]))
odE) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' (xa\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookup_pd_slot pd vaddr), unsigned_eret_2_' := from_bool (armPageCacheable attr), unsigned_eret_3_' := from_bool (armExecuteNever attr), ret__struct_pde_C_' := ret__struct_pde_C_' t, ret__unsigned_' := SCAST(32 signed \<rightarrow> 32) pde_pde_invalid, currentPDEType_' := pde_pde_invalid, ret__int_' := 0, ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_create_mappings_pde_return_C_' xa))), ret__struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_create_mappings_pde_return_C_' xa))), global_exn_var_' := Return\<rparr>)))))
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7487 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7489 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (IF vsz = Wellformed_C.ARMSuperSection THEN
  \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C)));;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> ?R7487 pda attra vmRights frameSize vaddra basea s)) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> ?T7489 pda attra vmRights frameSize vaddra basea)} proof (prove)
goal (4 subgoals):
 1. \<And>attra vmRights x \<sigma> xa v t ta tb tc. \<lbrakk>vsz = Wellformed_C.ARMSection; vmsz_aligned' vaddr Wellformed_C.ARMSection; vmRights < 4; vrights = vmrights_to_H vmRights; (\<sigma>, xa) \<in> rf_sr; vmsz_aligned' base Wellformed_C.ARMSection; is_aligned pd pdBits; cslift xa (pde_Ptr (lookup_pd_slot pd vaddr)) = Some v; cpde_relation x v; array_assertion (pde_Ptr pd) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals xa))); ret__ptr_to_struct_pde_C_' t = pde_Ptr (lookup_pd_slot pd vaddr); ret__unsigned_' ta = from_bool (armParityEnabled attr); ret__unsigned_' tb = from_bool (armPageCacheable attr); ret__unsigned_' tc = from_bool (armExecuteNever attr); armParityEnabled_CL (vm_attributes_lift attra) = from_bool (armParityEnabled attr); armPageCacheable_CL (vm_attributes_lift attra) = from_bool (armPageCacheable attr); armExecuteNever_CL (vm_attributes_lift attra) = from_bool (armExecuteNever attr)\<rbrakk> \<Longrightarrow> vmsz_aligned' base (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection))
 2. \<And>attra vmRights x \<sigma> xa v t ta tb tc. \<lbrakk>vsz = Wellformed_C.ARMSection; vmsz_aligned' vaddr Wellformed_C.ARMSection; vmRights < 4; vrights = vmrights_to_H vmRights; (\<sigma>, xa) \<in> rf_sr; vmsz_aligned' base Wellformed_C.ARMSection; is_aligned pd pdBits; cslift xa (pde_Ptr (lookup_pd_slot pd vaddr)) = Some v; cpde_relation x v; array_assertion (pde_Ptr pd) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals xa))); ret__ptr_to_struct_pde_C_' t = pde_Ptr (lookup_pd_slot pd vaddr); ret__unsigned_' ta = from_bool (armParityEnabled attr); ret__unsigned_' tb = from_bool (armPageCacheable attr); ret__unsigned_' tc = from_bool (armExecuteNever attr); armParityEnabled_CL (vm_attributes_lift attra) = from_bool (armParityEnabled attr); armPageCacheable_CL (vm_attributes_lift attra) = from_bool (armPageCacheable attr); armExecuteNever_CL (vm_attributes_lift attra) = from_bool (armExecuteNever attr)\<rbrakk> \<Longrightarrow> \<forall>t. pde_lift (ret__struct_pde_C_' t) = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = 0, nG_CL = 1, S_CL = s_from_cacheable (armPageCacheable attr), APX_CL = 0, TEX_CL = tex_from_cacheable (armPageCacheable attr), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = from_bool (armParityEnabled attr), Domain_CL = 0, XN_CL = from_bool (armExecuteNever attr), C_CL = 0, B_CL = b_from_cacheable (armPageCacheable attr)\<rparr>) \<longrightarrow> (\<exists>t. ret__unsigned_' t = pde_get_tag v) \<longrightarrow> (pde_get_tag v \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (pde_get_tag v \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> (\<exists>x\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights), [lookup_pd_slot pd vaddr]))
odE) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) (current_syscall_error_' (globals xa)))) (xa\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookup_pd_slot pd vaddr), unsigned_eret_2_' := from_bool (armPageCacheable attr), unsigned_eret_3_' := from_bool (armExecuteNever attr), ret__struct_pde_C_' := ret__struct_pde_C_' t, ret__unsigned_' := pde_get_tag v, currentPDEType_' := UCAST(32 \<rightarrow> 32 signed) (pde_get_tag v), ret__int_' := 1\<rparr>)\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (ret___struct_create_mappings_pde_return_C_' xa))), ret__struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (ret___struct_create_mappings_pde_return_C_' xa))), global_exn_var_' := Return\<rparr>)))) \<and> (pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> (\<exists>t. ret__unsigned_' t = size_CL (pde_pde_section_lift v)) \<longrightarrow> (size_CL (pde_pde_section_lift v) \<noteq> 0 \<longrightarrow> (\<exists>x\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights), [lookup_pd_slot pd vaddr]))
odE) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) (current_syscall_error_' (globals xa)))) (xa\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookup_pd_slot pd vaddr), unsigned_eret_2_' := from_bool (armPageCacheable attr), unsigned_eret_3_' := from_bool (armExecuteNever attr), ret__struct_pde_C_' := ret__struct_pde_C_' t, currentPDEType_' := pde_pde_section, ret__unsigned_' := size_CL (pde_pde_section_lift v), ret__int_' := 1\<rparr>)\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (ret___struct_create_mappings_pde_return_C_' xa))), ret__struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (ret___struct_create_mappings_pde_return_C_' xa))), global_exn_var_' := Return\<rparr>)))) \<and> (size_CL (pde_pde_section_lift v) = 0 \<longrightarrow> (\<exists>x\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights), [lookup_pd_slot pd vaddr]))
odE) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' (xa\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookup_pd_slot pd vaddr), unsigned_eret_2_' := from_bool (armPageCacheable attr), unsigned_eret_3_' := from_bool (armExecuteNever attr), ret__struct_pde_C_' := ret__struct_pde_C_' t, currentPDEType_' := pde_pde_section, ret__unsigned_' := 0, ret__int_' := 0, ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_create_mappings_pde_return_C_' xa))), ret__struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_create_mappings_pde_return_C_' xa))), global_exn_var_' := Return\<rparr>)))))) \<and> (pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (\<exists>x\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights), [lookup_pd_slot pd vaddr]))
odE) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' (xa\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookup_pd_slot pd vaddr), unsigned_eret_2_' := from_bool (armPageCacheable attr), unsigned_eret_3_' := from_bool (armExecuteNever attr), ret__struct_pde_C_' := ret__struct_pde_C_' t, ret__unsigned_' := SCAST(32 signed \<rightarrow> 32) pde_pde_invalid, currentPDEType_' := pde_pde_invalid, ret__int_' := 0, ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_create_mappings_pde_return_C_' xa))), ret__struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_create_mappings_pde_return_C_' xa))), global_exn_var_' := Return\<rparr>))))
 3. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7487 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7489 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (IF vsz = Wellformed_C.ARMSuperSection THEN
  \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C)));;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
ELSE
  Guard DontReach {} SKIP
FI)
 4. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> ?R7487 pda attra vmRights frameSize vaddra basea s)) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> ?T7489 pda attra vmRights frameSize vaddra basea)} proof (prove)
goal (3 subgoals):
 1. \<And>attra vmRights x \<sigma> xa v t ta tb tc. \<lbrakk>vsz = Wellformed_C.ARMSection; vmsz_aligned' vaddr Wellformed_C.ARMSection; vmRights < 4; vrights = vmrights_to_H vmRights; (\<sigma>, xa) \<in> rf_sr; vmsz_aligned' base Wellformed_C.ARMSection; is_aligned pd pdBits; cslift xa (pde_Ptr (lookup_pd_slot pd vaddr)) = Some v; cpde_relation x v; array_assertion (pde_Ptr pd) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals xa))); ret__ptr_to_struct_pde_C_' t = pde_Ptr (lookup_pd_slot pd vaddr); ret__unsigned_' ta = from_bool (armParityEnabled attr); ret__unsigned_' tb = from_bool (armPageCacheable attr); ret__unsigned_' tc = from_bool (armExecuteNever attr); armParityEnabled_CL (vm_attributes_lift attra) = from_bool (armParityEnabled attr); armPageCacheable_CL (vm_attributes_lift attra) = from_bool (armPageCacheable attr); armExecuteNever_CL (vm_attributes_lift attra) = from_bool (armExecuteNever attr)\<rbrakk> \<Longrightarrow> \<forall>t. pde_lift (ret__struct_pde_C_' t) = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = 0, nG_CL = 1, S_CL = s_from_cacheable (armPageCacheable attr), APX_CL = 0, TEX_CL = tex_from_cacheable (armPageCacheable attr), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = from_bool (armParityEnabled attr), Domain_CL = 0, XN_CL = from_bool (armExecuteNever attr), C_CL = 0, B_CL = b_from_cacheable (armPageCacheable attr)\<rparr>) \<longrightarrow> (\<exists>t. ret__unsigned_' t = pde_get_tag v) \<longrightarrow> (pde_get_tag v \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (pde_get_tag v \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> (\<exists>x\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights), [lookup_pd_slot pd vaddr]))
odE) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) (current_syscall_error_' (globals xa)))) (xa\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookup_pd_slot pd vaddr), unsigned_eret_2_' := from_bool (armPageCacheable attr), unsigned_eret_3_' := from_bool (armExecuteNever attr), ret__struct_pde_C_' := ret__struct_pde_C_' t, ret__unsigned_' := pde_get_tag v, currentPDEType_' := UCAST(32 \<rightarrow> 32 signed) (pde_get_tag v), ret__int_' := 1\<rparr>)\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (ret___struct_create_mappings_pde_return_C_' xa))), ret__struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (ret___struct_create_mappings_pde_return_C_' xa))), global_exn_var_' := Return\<rparr>)))) \<and> (pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> (\<exists>t. ret__unsigned_' t = size_CL (pde_pde_section_lift v)) \<longrightarrow> (size_CL (pde_pde_section_lift v) \<noteq> 0 \<longrightarrow> (\<exists>x\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights), [lookup_pd_slot pd vaddr]))
odE) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) (current_syscall_error_' (globals xa)))) (xa\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookup_pd_slot pd vaddr), unsigned_eret_2_' := from_bool (armPageCacheable attr), unsigned_eret_3_' := from_bool (armExecuteNever attr), ret__struct_pde_C_' := ret__struct_pde_C_' t, currentPDEType_' := pde_pde_section, ret__unsigned_' := size_CL (pde_pde_section_lift v), ret__int_' := 1\<rparr>)\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (ret___struct_create_mappings_pde_return_C_' xa))), ret__struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (ret___struct_create_mappings_pde_return_C_' xa))), global_exn_var_' := Return\<rparr>)))) \<and> (size_CL (pde_pde_section_lift v) = 0 \<longrightarrow> (\<exists>x\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights), [lookup_pd_slot pd vaddr]))
odE) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' (xa\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookup_pd_slot pd vaddr), unsigned_eret_2_' := from_bool (armPageCacheable attr), unsigned_eret_3_' := from_bool (armExecuteNever attr), ret__struct_pde_C_' := ret__struct_pde_C_' t, currentPDEType_' := pde_pde_section, ret__unsigned_' := 0, ret__int_' := 0, ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_create_mappings_pde_return_C_' xa))), ret__struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_create_mappings_pde_return_C_' xa))), global_exn_var_' := Return\<rparr>)))))) \<and> (pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (\<exists>x\<in>fst ((doE y <- case x of ARM_H.PageTablePDE word1 bool word2 \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | ARM_H.SuperSectionPDE word bool1 bool2 bool3 bool4 vmrights \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst | _ \<Rightarrow> returnOk ();
returnOk (Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights), [lookup_pd_slot pd vaddr]))
odE) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', xa) \<in> rf_sr \<and> (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' (xa\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookup_pd_slot pd vaddr), unsigned_eret_2_' := from_bool (armPageCacheable attr), unsigned_eret_3_' := from_bool (armExecuteNever attr), ret__struct_pde_C_' := ret__struct_pde_C_' t, ret__unsigned_' := SCAST(32 signed \<rightarrow> 32) pde_pde_invalid, currentPDEType_' := pde_pde_invalid, ret__int_' := 0, ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_create_mappings_pde_return_C_' xa))), ret__struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.length_C_update (\<lambda>v. 1) \<circ> pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookup_pd_slot pd vaddr))) (pde_C_update (\<lambda>v. ret__struct_pde_C_' t) (create_mappings_pde_return_C.status_C_update (\<lambda>v. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (ret___struct_create_mappings_pde_return_C_' xa))), global_exn_var_' := Return\<rparr>))))
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7487 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7489 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (IF vsz = Wellformed_C.ARMSuperSection THEN
  \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C)));;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> ?R7487 pda attra vmRights frameSize vaddra basea s)) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> ?T7489 pda attra vmRights frameSize vaddra basea)} proof (prove)
goal (3 subgoals):
 1. \<And>attra vmRights x \<sigma> xa v t ta tb tc td te. \<lbrakk>vsz = Wellformed_C.ARMSection; vmsz_aligned' vaddr Wellformed_C.ARMSection; vmRights < 4; vrights = vmrights_to_H vmRights; (\<sigma>, xa) \<in> rf_sr; vmsz_aligned' base Wellformed_C.ARMSection; is_aligned pd pdBits; cslift xa (pde_Ptr (lookup_pd_slot pd vaddr)) = Some v; cpde_relation x v; array_assertion (pde_Ptr pd) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals xa))); ret__ptr_to_struct_pde_C_' t = pde_Ptr (lookup_pd_slot pd vaddr); ret__unsigned_' ta = from_bool (armParityEnabled attr); ret__unsigned_' tb = from_bool (armPageCacheable attr); ret__unsigned_' tc = from_bool (armExecuteNever attr); armParityEnabled_CL (vm_attributes_lift attra) = from_bool (armParityEnabled attr); armPageCacheable_CL (vm_attributes_lift attra) = from_bool (armPageCacheable attr); armExecuteNever_CL (vm_attributes_lift attra) = from_bool (armExecuteNever attr); pde_lift (ret__struct_pde_C_' td) = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = 0, nG_CL = 1, S_CL = s_from_cacheable (armPageCacheable attr), APX_CL = 0, TEX_CL = tex_from_cacheable (armPageCacheable attr), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = from_bool (armParityEnabled attr), Domain_CL = 0, XN_CL = from_bool (armExecuteNever attr), C_CL = 0, B_CL = b_from_cacheable (armPageCacheable attr)\<rparr>); ret__unsigned_' te = pde_get_tag v\<rbrakk> \<Longrightarrow> (pde_get_tag v \<noteq> 0 \<longrightarrow> pde_get_tag v = 2 \<longrightarrow> (\<exists>t. ret__unsigned_' t = size_CL (pde_pde_section_lift v)) \<longrightarrow> size_CL (pde_pde_section_lift v) = 0 \<longrightarrow> cpde_relation (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights)) (ret__struct_pde_C_' td)) \<and> (pde_get_tag v = 0 \<longrightarrow> cpde_relation (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights)) (ret__struct_pde_C_' td))
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7487 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7489 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (IF vsz = Wellformed_C.ARMSuperSection THEN
  \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C)));;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
ELSE
  Guard DontReach {} SKIP
FI)
 3. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> ?R7487 pda attra vmRights frameSize vaddra basea s)) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> ?T7489 pda attra vmRights frameSize vaddra basea)} proof (prove)
goal (2 subgoals):
 1. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7487 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7489 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (IF vsz = Wellformed_C.ARMSuperSection THEN
  \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C)));;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
ELSE
  Guard DontReach {} SKIP
FI)
 2. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> ?R7487 pda attra vmRights frameSize vaddra basea s)) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> ?T7489 pda attra vmRights frameSize vaddra basea)} proof (prove)
goal (3 subgoals):
 1. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (\<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C)));;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_')
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 3. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> ?Q7773 pda attra vmRights frameSize vaddra basea s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})} proof (prove)
goal (3 subgoals):
 1. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) [SKIP] (doE y <- mapME_x (\<lambda>slot. liftE (getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ())) (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets);
returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))
odE) (\<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C)));;
\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
\<acute>i :== 0;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_')
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 3. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> ?Q7773 pda attra vmRights frameSize vaddra basea s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})} proof (prove)
goal (3 subgoals):
 1. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) [SKIP] (doE y <- mapME_x (\<lambda>slot. liftE (getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ())) (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets);
returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))
odE) (\<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
(\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
(Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C)));;
(\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
(\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
(\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
(\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
(\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
(\<acute>i :== 0;;
(Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
(\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_')))))))))))
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 3. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> ?Q7773 pda attra vmRights frameSize vaddra basea s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})} proof (prove)
goal (3 subgoals):
 1. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) [SKIP] (doE y <- mapME_x (\<lambda>slot. liftE (getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ())) (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets);
returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))
odE) (\<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
(Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C)));;
(\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
(\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
(\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
(\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
(\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
(\<acute>i :== 0;;
(Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
(\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'))))))))))
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 3. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> ?Q7773 pda attra vmRights frameSize vaddra basea s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})} proof (prove)
goal (5 subgoals):
 1. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) (?Q'7837 pda attra vmRights vaddra basea) [SKIP] (doE y <- mapME_x (\<lambda>slot. liftE (getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ())) (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets);
returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))
odE) (Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C)));;
(\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
(\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
(\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
(\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
(\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
(\<acute>i :== 0;;
(Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
(\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_')))))))))
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C (?Q'7837 pda attra vmRights vaddra basea)
 3. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 4. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 5. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> ?Q7773 pda attra vmRights frameSize vaddra basea s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})} proof (prove)
goal (5 subgoals):
 1. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) (?C'7849 pda attra vmRights vaddra basea) [SKIP] (doE y <- mapME_x (\<lambda>slot. liftE (getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ())) (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets);
returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))
odE) (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C;;
(\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
(\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
(\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
(\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
(\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) \<acute>ret___struct_create_mappings_pde_return_C;;
(\<acute>i :== 0;;
(Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
(\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_')))))))))
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C (?C'7849 pda attra vmRights vaddra basea \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 3. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 4. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 5. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> ?Q7773 pda attra vmRights frameSize vaddra basea s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})} proof (prove)
goal (5 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) (?G'7922 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C) [SKIP] (doE y <- mapME_x (\<lambda>slot. liftE (getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ())) (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets);
returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))
odE) (\<acute>ret__unsigned :== CALL vm_attributes_get_armParityEnabled_'proc(attra);;
(\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
(\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
(\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,\<acute>ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
(\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C ret___struct_create_mappings_pde_return_C)) ret___struct_create_mappings_pde_return_C);;
(\<acute>i :== 0;;
(Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
(\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'))))))))
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> ?G'7922 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s)}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 3. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 4. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 5. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> ?Q7773 pda attra vmRights frameSize vaddra basea s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})} proof (prove)
goal (5 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra)\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) (?G'8093 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned) [SKIP] (doE y <- mapME_x (\<lambda>slot. liftE (getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ())) (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets);
returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))
odE) (\<acute>unsigned_eret_2 :== CALL vm_attributes_get_armPageCacheable_'proc(attra);;
(\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
(\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,ret__unsigned,\<acute>unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
(\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C ret___struct_create_mappings_pde_return_C)) ret___struct_create_mappings_pde_return_C);;
(\<acute>i :== 0;;
(Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
(\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_')))))))
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'8093 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 3. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 4. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 5. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> ?Q7773 pda attra vmRights frameSize vaddra basea s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})} proof (prove)
goal (5 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra)\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) (?G'8406 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2) [SKIP] (doE y <- mapME_x (\<lambda>slot. liftE (getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ())) (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets);
returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))
odE) (\<acute>unsigned_eret_3 :== CALL vm_attributes_get_armExecuteNever_'proc(attra);;
(\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,ret__unsigned,unsigned_eret_2,\<acute>unsigned_eret_3,0,vmRights);;
(\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C ret___struct_create_mappings_pde_return_C)) ret___struct_create_mappings_pde_return_C);;
(\<acute>i :== 0;;
(Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
(\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'))))))
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> ?G'8406 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 3. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 4. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 5. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> ?Q7773 pda attra vmRights frameSize vaddra basea s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})} proof (prove)
goal (5 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra)\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) (?G'8834 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3) [SKIP] (doE y <- mapME_x (\<lambda>slot. liftE (getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ())) (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets);
returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))
odE) (\<acute>ret__struct_pde_C :== CALL makeUserPDE_'proc(SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection,base,ret__unsigned,unsigned_eret_2,unsigned_eret_3,0,vmRights);;
(\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. \<acute>ret__struct_pde_C) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C ret___struct_create_mappings_pde_return_C)) ret___struct_create_mappings_pde_return_C);;
(\<acute>i :== 0;;
(Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
(\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_')))))
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> ?G'8834 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 3. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 4. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 5. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> ?Q7773 pda attra vmRights frameSize vaddra basea s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})} proof (prove)
goal (5 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable unsigned_eret_2, APX_CL = 0, TEX_CL = tex_bits_from_cacheable unsigned_eret_2, AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = ret__unsigned, Domain_CL = 0, XN_CL = unsigned_eret_3, C_CL = 0, B_CL = iwb_from_cacheable unsigned_eret_2\<rparr>)\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) (?G'9229 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C) [SKIP] (doE y <- mapME_x (\<lambda>slot. liftE (getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ())) (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets);
returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))
odE) (\<acute>ret___struct_create_mappings_pde_return_C :== pde_C_update (\<lambda>_. ret__struct_pde_C) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C ret___struct_create_mappings_pde_return_C)) ret___struct_create_mappings_pde_return_C);;
(\<acute>i :== 0;;
(Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits) DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace> (Guard ShiftError \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> (Guard SignedArithmetic \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> SKIP))
OD)));;
(\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'))))
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> ?G'9229 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 3. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 4. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 5. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> ?Q7773 pda attra vmRights frameSize vaddra basea s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})} proof (prove)
goal (5 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) (?G'9229 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) ret__struct_pde_C) [SKIP] (doE x <- sequenceE (map ((\<lambda>slot. liftE (getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ())) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets);
returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))
odE) (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C);;
(\<acute>i :== 0;;
(Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) (WHILE \<acute>i < 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}) (Guard ShiftError (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) (Guard SignedArithmetic (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) SKIP))
OD)));;
(\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'))))
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> ?G'9229 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 3. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 4. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 5. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> ?Q7773 pda attra vmRights frameSize vaddra basea s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})} proof (prove)
goal (5 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) (?G'9229 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) ret__struct_pde_C) [SKIP] (doE x <- sequenceE (map ((\<lambda>slot. liftE (getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ())) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets);
returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))
odE) (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C);;
(\<acute>i :== 0;;
(Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV (WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD)));;
(\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'))))
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> ?G'9229 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 3. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 4. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 5. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> ?Q7773 pda attra vmRights frameSize vaddra basea s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})} proof (prove)
goal (5 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) (?G'9601 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') [SKIP] (doE x <- sequenceE (map ((\<lambda>slot. liftE (getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ())) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets);
returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))
odE) (\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C);;
(\<acute>i :== 0;;
(WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s)) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD;;
(\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) \<acute>ret___struct_create_mappings_pde_return_C;;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'))))
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> ?G'9600 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 3. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 4. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 5. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> ?Q7773 pda attra vmRights frameSize vaddra basea s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})}
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?G'9601 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?G'9600 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (5 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) (?G'9660 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') [SKIP] (doE x <- sequenceE (map ((\<lambda>slot. liftE (getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ())) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets);
returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))
odE) (\<acute>i :== 0;;
(WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD;;
(\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_')))
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> ?G'9661 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 3. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ?Q7773 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 4. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 5. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> ?Q7773 pda attra vmRights frameSize vaddra basea s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})}
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?G'9661 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?G'9660 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () proof (prove)
goal (9 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (?r'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv')) (?xf'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv') (inl_rrel (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv')))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?P10017 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) (?P'10014 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') [SKIP] (sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)) (\<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD)
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv') rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); ?r'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (?r'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv')) (?xf'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv') (\<lambda>v. ?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' (theRight v))),UNIV
 6. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> ?P'10012 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 7. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (?P10017 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base and ?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 8. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 9. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (?P10017 pda attra vmRights frameSize vaddra basea and ?R10015 pda attra vmRights frameSize vaddra basea) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})}
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?P'10014 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?P'10012 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra))
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (9 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (?r'10006 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) ret__struct_pde_C rv')) (?xf'10006 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) ret__struct_pde_C rv') (inl_rrel (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv')))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?P10017 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) (?P'10014 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') [SKIP] (sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < 0x10\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))))
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv') rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); ?r'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (?r'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv')) (?xf'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv') (\<lambda>v. ?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' (theRight v))),UNIV
 6. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> ?P'10012 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 7. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (?P10017 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base and ?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 8. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 9. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (?P10017 pda attra vmRights frameSize vaddra basea and ?R10015 pda attra vmRights frameSize vaddra basea) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})}
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?P'10014 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?P'10012 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra))
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (9 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (?r'10006 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) ret__struct_pde_C rv')) (?xf'10006 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) ret__struct_pde_C rv') (inl_rrel (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv')))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?P10017 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) (?G'10031 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv' rv'a) [SKIP] (sequenceE (map ((\<lambda>slot. liftE (getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ())) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < 0x10\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1))
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv') rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); ?r'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (?r'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv')) (?xf'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv') (\<lambda>v. ?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' (theRight v))),UNIV
 6. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> ?G'10032 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 7. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (?P10017 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base and ?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 8. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 9. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (?P10017 pda attra vmRights frameSize vaddra basea and ?R10015 pda attra vmRights frameSize vaddra basea) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})}
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?G'10032 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?G'10031 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () ()
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (14 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv. dc (ys @ [rv]))) xfdc (inl_rrel (inl_rrel (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (page_directory_at' pd) (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> {s. i_' s = word_of_nat (length ys) \<and> dc ys (xfdc s)}) [SKIP] (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! length ys) (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI)
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); case rv'a of (i', rv') \<Rightarrow> dc rv rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets)))) (\<lambda>a. (i_' a, xfdc a)) (\<lambda>v. ?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' (theRight v))),UNIV
A total of 14 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (14 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv. dc (ys @ [rv]))) xfdc (inl_rrel (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv')))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (page_directory_at' pd) ((if pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr) then UNIV else {}) \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>) [SKIP] (getObject (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) >>= ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ())) (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI)
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); case rv'a of (i', rv') \<Rightarrow> dc rv rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets)))) (\<lambda>a. (i_' a, xfdc a)) (\<lambda>v. ?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' (theRight v))),UNIV
A total of 14 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (15 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv. dc (ys @ [rv]))) xfdc (inl_rrel (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv')))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q20198 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys) (?Q'20198 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys) [SKIP] (getObject (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) >>= ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ())) (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI)
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys s s'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> (if pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr) then UNIV else {}) \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>\<rbrakk> \<Longrightarrow> ?Q20198 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys s \<and> s' \<in> ?Q'20198 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); case rv'a of (i', rv') \<Rightarrow> dc rv rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (19 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)) ret__int_' (?P20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys) (?Q'20198 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys) [] (getObject (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr)) (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI)
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv' t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI) (?d'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv')
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv. dc (ys @ [rv]))) xfdc (inl_rrel (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv')))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv) (?Q'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv') [SKIP] (case rv of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst) (?d'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv')
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> \<lbrace>?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace> getObject (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) \<lbrace>?Q20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace>
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)) ret__int_' (?Q'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys)
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys s s'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> (if pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr) then UNIV else {}) \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>\<rbrakk> \<Longrightarrow> (?P20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys and ?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys) s \<and> s' \<in> ?Q'20198 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
A total of 19 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (19 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys x. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> ccorres (\<lambda>rv rv'. rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)) ret__int_' (?P20206 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys x) (?P'20206 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys x) [] (return x) (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI)
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv' t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI) (?d'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv')
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv. dc (ys @ [rv]))) xfdc (inl_rrel (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv')))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv) (?Q'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv') [SKIP] (case rv of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst) (?d'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv')
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> \<lbrace>?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace> getObject (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) \<lbrace>?Q20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace>
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)) ret__int_' (?Q'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys)
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys s s'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> (if pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr) then UNIV else {}) \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>pde. ko_at' pde (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) s \<longrightarrow> ?P20206 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys pde s) and ?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys) s \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> ?P'20206 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys pde}
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
A total of 19 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (19 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys x. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> {s. let ptr = pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) in \<exists>v. cslift s (ptr +\<^sub>p uint (i_' s)) = Some v \<and> cpde_relation x v \<and> (i_' s = 0 \<or> array_assertion ptr (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s))))} \<and> (\<sigma>, s) \<in> rf_sr} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI {s. \<not> snd (return x \<sigma>) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return x \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ret__int_' s = from_bool (isPageTablePDE rv \<or> isSectionPDE rv))}
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv' t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI) (?d'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv')
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv. dc (ys @ [rv]))) xfdc (inl_rrel (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv')))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv) (?Q'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv') [SKIP] (case rv of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst) (?d'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv')
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> \<lbrace>?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace> getObject (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) \<lbrace>?Q20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace>
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)) ret__int_' (?Q'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys)
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys s s'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> (if pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr) then UNIV else {}) \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>pde. ko_at' pde (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) s \<longrightarrow> True) and ?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys) s \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. let ptr = pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) in \<exists>v. cslift s (ptr +\<^sub>p uint (i_' s)) = Some v \<and> cpde_relation pde v \<and> (i_' s = 0 \<or> array_assertion ptr (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s))))}}
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
A total of 19 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (19 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys x \<sigma>. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> {s. let ptr = pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) in \<exists>v. cslift s (ptr +\<^sub>p uint (i_' s)) = Some v \<and> cpde_relation x v \<and> (i_' s = 0 \<or> array_assertion ptr (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s))))} \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (i_' s = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat (i_' s)) (hrs_htd (t_hrs_' (globals s)))) \<and> s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s)) \<and> (i_' s = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s)))) \<and> (\<forall>t. ret__unsigned_' t = pde_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))) \<longrightarrow> (i_' s = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s)))) \<and> ((if UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s)))) \<noteq> pde_pde_invalid then 1 else 0) \<noteq> 0 \<longrightarrow> ((if UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s)))) \<noteq> pde_pde_section then 1 else 0) \<noteq> 0 \<longrightarrow> \<not> snd (return x \<sigma>) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return x \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := pde_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))), currentPDEType_' := UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s)))), ret__int_' := if UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s)))) \<noteq> pde_pde_section then 1 else 0\<rparr>) \<in> rf_sr \<and> (if UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s)))) \<noteq> pde_pde_section then 1 else 0) = from_bool (isPageTablePDE rv \<or> isSectionPDE rv))) \<and> ((if UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s)))) \<noteq> pde_pde_section then 1 else 0) = 0 \<longrightarrow> (i_' s = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat (i_' s)) (hrs_htd (t_hrs_' (globals s)))) \<and> s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s)) \<and> (i_' s = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s)))) \<and> pde_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))) = SCAST(32 signed \<rightarrow> 32) pde_pde_section \<and> (\<forall>t. ret__unsigned_' t = size_CL (pde_pde_section_lift (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s)))) \<longrightarrow> (i_' s = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s)))) \<and> (\<not> snd (return x \<sigma>) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return x \<sigma>). (\<sigma>', s\<lparr>currentPDEType_' := UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s)))), ret__unsigned_' := size_CL (pde_pde_section_lift (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s)))), ret__int_' := if size_CL (pde_pde_section_lift (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s)))) \<noteq> 1 then 1 else 0\<rparr>) \<in> rf_sr \<and> (if size_CL (pde_pde_section_lift (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s)))) \<noteq> 1 then 1 else 0) = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)))))) \<and> ((if UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s)))) \<noteq> pde_pde_invalid then 1 else 0) = 0 \<longrightarrow> \<not> snd (return x \<sigma>) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return x \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := pde_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))), currentPDEType_' := UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s)))), ret__int_' := 0\<rparr>) \<in> rf_sr \<and> 0 = from_bool (isPageTablePDE rv \<or> isSectionPDE rv))))}
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv' t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI) (?d'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv')
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv. dc (ys @ [rv]))) xfdc (inl_rrel (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv')))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv) (?Q'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv') [SKIP] (case rv of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst) (?d'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv')
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> \<lbrace>?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace> getObject (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) \<lbrace>?Q20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace>
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)) ret__int_' (?Q'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys)
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys s s'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> (if pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr) then UNIV else {}) \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>pde. ko_at' pde (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) s \<longrightarrow> True) and ?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys) s \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. let ptr = pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) in \<exists>v. cslift s (ptr +\<^sub>p uint (i_' s)) = Some v \<and> cpde_relation pde v \<and> (i_' s = 0 \<or> array_assertion ptr (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s))))}}
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
A total of 19 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (19 subgoals):
 1. \<And>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C ys x \<sigma> xa v. \<lbrakk>lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; vm_attribs_relation attr attra; vsz = Wellformed_C.ARMSuperSection; pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; vmsz_aligned' vaddr Wellformed_C.ARMSuperSection; vmRights < 4; vrights = vmrights_to_H vmRights; (\<sigma>, xa) \<in> rf_sr; vmsz_aligned' base Wellformed_C.ARMSuperSection; is_aligned pd pdBits; cslift xa (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' xa)) = Some v; cpde_relation x v; i_' xa = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat (i_' xa))) (hrs_htd (t_hrs_' (globals xa)))\<rbrakk> \<Longrightarrow> (i_' xa = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat (i_' xa)) (hrs_htd (t_hrs_' (globals xa)))) \<and> ((\<exists>t. ret__unsigned_' t = pde_get_tag v) \<longrightarrow> (pde_get_tag v \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> (pde_get_tag v \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> isPageTablePDE x \<or> isSectionPDE x) \<and> (pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> (i_' xa = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat (i_' xa)) (hrs_htd (t_hrs_' (globals xa)))) \<and> ((\<exists>t. ret__unsigned_' t = size_CL (pde_pde_section_lift v)) \<longrightarrow> (if size_CL (pde_pde_section_lift v) \<noteq> 1 then 1 else 0) = from_bool (isPageTablePDE x \<or> isSectionPDE x)))) \<and> (pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> from_bool (isPageTablePDE x \<or> isSectionPDE x) = 0))
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv' t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI) (?d'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv')
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv. dc (ys @ [rv]))) xfdc (inl_rrel (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv')))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv) (?Q'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv') [SKIP] (case rv of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst) (?d'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv')
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> \<lbrace>?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace> getObject (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) \<lbrace>?Q20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace>
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)) ret__int_' (?Q'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys)
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys s s'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> (if pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr) then UNIV else {}) \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>pde. ko_at' pde (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) s \<longrightarrow> True) and ?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys) s \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. let ptr = pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) in \<exists>v. cslift s (ptr +\<^sub>p uint (i_' s)) = Some v \<and> cpde_relation pde v \<and> (i_' s = 0 \<or> array_assertion ptr (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s))))}}
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
A total of 19 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (19 subgoals):
 1. \<And>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C ys x \<sigma> xa v. \<lbrakk>lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; vm_attribs_relation attr attra; vsz = Wellformed_C.ARMSuperSection; pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; vmsz_aligned' vaddr Wellformed_C.ARMSuperSection; vmRights < 4; vrights = vmrights_to_H vmRights; (\<sigma>, xa) \<in> rf_sr; vmsz_aligned' base Wellformed_C.ARMSuperSection; is_aligned pd pdBits; cslift xa (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' xa)) = Some v; cpde_relation x v; i_' xa = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat (i_' xa))) (hrs_htd (t_hrs_' (globals xa)))\<rbrakk> \<Longrightarrow> (i_' xa = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat (i_' xa)) (hrs_htd (t_hrs_' (globals xa)))) \<and> ((\<exists>t. ret__unsigned_' t = pde_get_tag v) \<longrightarrow> pde_get_tag v \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_invalid \<longrightarrow> pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> (i_' xa = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat (i_' xa)) (hrs_htd (t_hrs_' (globals xa)))) \<and> ((\<exists>t. ret__unsigned_' t = size_CL (pde_pde_section_lift v)) \<longrightarrow> (if size_CL (pde_pde_section_lift v) \<noteq> 1 then 1 else 0) = from_bool ((if pde_pde_section = pde_pde_invalid then False else if pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse \<or> pde_get_tag v \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section then True else if size_CL (pde_pde_section_lift v) = 0 then False else False) \<or> (if pde_pde_section = pde_pde_invalid then False else if pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse \<or> pde_get_tag v \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section then False else if size_CL (pde_pde_section_lift v) = 0 then True else False))))
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv' t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI) (?d'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv')
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv. dc (ys @ [rv]))) xfdc (inl_rrel (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv')))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv) (?Q'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv') [SKIP] (case rv of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst) (?d'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv')
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> \<lbrace>?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace> getObject (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) \<lbrace>?Q20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace>
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)) ret__int_' (?Q'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys)
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys s s'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> (if pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr) then UNIV else {}) \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>pde. ko_at' pde (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) s \<longrightarrow> True) and ?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys) s \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. let ptr = pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) in \<exists>v. cslift s (ptr +\<^sub>p uint (i_' s)) = Some v \<and> cpde_relation pde v \<and> (i_' s = 0 \<or> array_assertion ptr (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s))))}}
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
A total of 19 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (19 subgoals):
 1. \<And>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C ys x \<sigma> xa v. \<lbrakk>lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; vm_attribs_relation attr attra; vsz = Wellformed_C.ARMSuperSection; pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; vmsz_aligned' vaddr Wellformed_C.ARMSuperSection; vmRights < 4; vrights = vmrights_to_H vmRights; (\<sigma>, xa) \<in> rf_sr; vmsz_aligned' base Wellformed_C.ARMSuperSection; is_aligned pd pdBits; cslift xa (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' xa)) = Some v; cpde_relation x v; i_' xa = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat (i_' xa))) (hrs_htd (t_hrs_' (globals xa))); \<exists>t. ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) pde_pde_section; pde_pde_section \<noteq> pde_pde_invalid; pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_section; \<exists>t. ret__unsigned_' t = size_CL (pde_pde_section_lift v)\<rbrakk> \<Longrightarrow> (if size_CL (pde_pde_section_lift v) \<noteq> 1 then 1 else 0) = from_bool ((if pde_pde_section = pde_pde_coarse then True else if size_CL (pde_pde_section_lift v) = 0 then False else False) \<or> (if pde_pde_section = pde_pde_coarse then False else if size_CL (pde_pde_section_lift v) = 0 then True else False))
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv' t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI) (?d'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv')
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv. dc (ys @ [rv]))) xfdc (inl_rrel (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv')))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv) (?Q'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv') [SKIP] (case rv of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst) (?d'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv')
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> \<lbrace>?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace> getObject (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) \<lbrace>?Q20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace>
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)) ret__int_' (?Q'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys)
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys s s'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> (if pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr) then UNIV else {}) \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>pde. ko_at' pde (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) s \<longrightarrow> True) and ?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys) s \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. let ptr = pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) in \<exists>v. cslift s (ptr +\<^sub>p uint (i_' s)) = Some v \<and> cpde_relation pde v \<and> (i_' s = 0 \<or> array_assertion ptr (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s))))}}
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
A total of 19 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (19 subgoals):
 1. \<And>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C ys x \<sigma> xa v t ta. \<lbrakk>lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; vm_attribs_relation attr attra; vsz = Wellformed_C.ARMSuperSection; pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; vmsz_aligned' vaddr Wellformed_C.ARMSuperSection; vmRights < 4; vrights = vmrights_to_H vmRights; (\<sigma>, xa) \<in> rf_sr; vmsz_aligned' base Wellformed_C.ARMSuperSection; is_aligned pd pdBits; cslift xa (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' xa)) = Some v; cpde_relation x v; i_' xa = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat (i_' xa))) (hrs_htd (t_hrs_' (globals xa))); pde_get_tag v = 2; ret__unsigned_' t = 2; ret__unsigned_' ta = size_CL (pde_pde_section_lift v); size_CL (pde_pde_section_lift v) \<noteq> 1\<rbrakk> \<Longrightarrow> size_CL (pde_pde_section_lift v) = 0
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv' t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI) (?d'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv')
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv. dc (ys @ [rv]))) xfdc (inl_rrel (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv')))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv) (?Q'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv') [SKIP] (case rv of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst) (?d'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv')
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> \<lbrace>?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace> getObject (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) \<lbrace>?Q20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace>
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)) ret__int_' (?Q'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys)
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys s s'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> (if pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr) then UNIV else {}) \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>pde. ko_at' pde (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) s \<longrightarrow> True) and ?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys) s \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. let ptr = pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) in \<exists>v. cslift s (ptr +\<^sub>p uint (i_' s)) = Some v \<and> cpde_relation pde v \<and> (i_' s = 0 \<or> array_assertion ptr (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s))))}}
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
A total of 19 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (18 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv' t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__int_' rv' t t' (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI) (?d'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv')
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv. dc (ys @ [rv]))) xfdc (inl_rrel (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv')))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv) (?Q'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv') [SKIP] (case rv of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst) (?d'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv')
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> \<lbrace>?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace> getObject (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) \<lbrace>?Q20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace>
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)) ret__int_' (?Q'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys)
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys s s'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> (if pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr) then UNIV else {}) \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>pde. ko_at' pde (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) s \<longrightarrow> True) and ?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys) s \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. let ptr = pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) in \<exists>v. cslift s (ptr +\<^sub>p uint (i_' s)) = Some v \<and> cpde_relation pde v \<and> (i_' s = 0 \<or> array_assertion ptr (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s))))}}
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (17 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv. dc (ys @ [rv]))) xfdc (inl_rrel (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv')))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv) (?Q'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv') [SKIP] (case rv of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst) (IF rv' \<noteq> 0 THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI)
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> \<lbrace>?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace> getObject (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) \<lbrace>?Q20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace>
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)) ret__int_' (?Q'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys)
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys s s'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> (if pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr) then UNIV else {}) \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>pde. ko_at' pde (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) s \<longrightarrow> True) and ?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys) s \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. let ptr = pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) in \<exists>v. cslift s (ptr +\<^sub>p uint (i_' s)) = Some v \<and> cpde_relation pde v \<and> (i_' s = 0 \<or> array_assertion ptr (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s))))}}
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
A total of 17 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (17 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel (\<lambda>rv. dc (ys @ [rv]))) xfdc (inl_rrel (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv')))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q20201 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) ret__struct_pde_C ys rv) (?Q'20201 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) ret__struct_pde_C ys rv (from_bool (isPageTablePDE rv \<or> isSectionPDE rv))) [SKIP] (case rv of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst) (IF isPageTablePDE rv \<or> isSectionPDE rv THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI)
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> \<lbrace>?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace> getObject (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) \<lbrace>?Q20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace>
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)) ret__int_' (?Q'20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys)
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys s s'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> (if pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr) then UNIV else {}) \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>pde. ko_at' pde (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) s \<longrightarrow> True) and ?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys) s \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. let ptr = pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) in \<exists>v. cslift s (ptr +\<^sub>p uint (i_' s)) = Some v \<and> cpde_relation pde v \<and> (i_' s = 0 \<or> array_assertion ptr (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s))))}}
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
A total of 17 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (17 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} IF isPageTablePDE rv \<or> isSectionPDE rv THEN
  \<acute>globals :== current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI {s. \<exists>(rv, \<sigma>')\<in>fst ((case rv of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> inr_rrel (\<lambda>rv. dc (ys @ [rv])) rv (xfdc s)},{s. \<exists>(rv, \<sigma>')\<in>fst ((case rv of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> inl_rrel (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' s)}
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> \<lbrace>?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace> getObject (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)) ret__int_' (\<lambda>a b. UNIV)
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys s s'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> (if pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr) then UNIV else {}) \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>pde. ko_at' pde (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) s \<longrightarrow> True) and ?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys) s \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. let ptr = pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) in \<exists>v. cslift s (ptr +\<^sub>p uint (i_' s)) = Some v \<and> cpde_relation pde v \<and> (i_' s = 0 \<or> array_assertion ptr (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s))))}}
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
A total of 17 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (17 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys rv rv' \<sigma>. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (isPageTablePDE rv \<or> isSectionPDE rv \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case rv of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst) \<sigma>). (\<sigma>', globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) (current_syscall_error_' (globals s)))) s\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C)), ret__struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> inl_rrel (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) rv (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_' (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) (current_syscall_error_' (globals s)))) s\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C)), ret__struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C)), global_exn_var_' := Return\<rparr>)))) \<and> (\<not> (isPageTablePDE rv \<or> isSectionPDE rv) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case rv of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> inr_rrel (\<lambda>rv. dc (ys @ [rv])) rv (xfdc s)))}
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> \<lbrace>?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace> getObject (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)) ret__int_' (\<lambda>a b. UNIV)
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys s s'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> (if pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr) then UNIV else {}) \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>pde. ko_at' pde (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) s \<longrightarrow> True) and ?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys) s \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. let ptr = pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) in \<exists>v. cslift s (ptr +\<^sub>p uint (i_' s)) = Some v \<and> cpde_relation pde v \<and> (i_' s = 0 \<or> array_assertion ptr (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s))))}}
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
A total of 17 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (17 subgoals):
 1. \<And>attra vmRights ret__struct_pde_C ys rv \<sigma>. \<lbrakk>lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; vm_attribs_relation attr attra; vsz = Wellformed_C.ARMSuperSection; pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; vmsz_aligned' vaddr Wellformed_C.ARMSuperSection; vmRights < 4; vrights = vmrights_to_H vmRights; vmsz_aligned' base Wellformed_C.ARMSuperSection; is_aligned pd pdBits\<rbrakk> \<Longrightarrow> ((\<exists>x21 x22 x23. rv = ARM_H.PageTablePDE x21 x22 x23) \<longrightarrow> {s. (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (\<sigma>, s) \<in> rf_sr \<and> EXCEPTION_SYSCALL_ERROR \<noteq> EXCEPTION_NONE \<and> syscall_error_rel Fault_H.syscall_error.DeleteFirst (SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (errstate (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) (current_syscall_error_' (globals s)))) s))}) \<and> ((\<exists>x31 x32 x33 x34 x35 x36 x37. rv = ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37) \<longrightarrow> {s. (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (\<sigma>, s) \<in> rf_sr \<and> EXCEPTION_SYSCALL_ERROR \<noteq> EXCEPTION_NONE \<and> syscall_error_rel Fault_H.syscall_error.DeleteFirst (SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (errstate (globals_update (current_syscall_error_'_update (\<lambda>_. type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) (current_syscall_error_' (globals s)))) s))})
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> \<lbrace>?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace> getObject (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)) ret__int_' (\<lambda>a b. UNIV)
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys s s'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> (if pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr) then UNIV else {}) \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>pde. ko_at' pde (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) s \<longrightarrow> True) and ?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys) s \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. let ptr = pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) in \<exists>v. cslift s (ptr +\<^sub>p uint (i_' s)) = Some v \<and> cpde_relation pde v \<and> (i_' s = 0 \<or> array_assertion ptr (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s))))}}
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
A total of 17 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (16 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> \<lbrace>?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys\<rbrace> getObject (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)) ret__int_' (\<lambda>a b. UNIV)
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys s s'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> (if pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr) then UNIV else {}) \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>pde. ko_at' pde (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) s \<longrightarrow> True) and ?R20201 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys) s \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. let ptr = pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) in \<exists>v. cslift s (ptr +\<^sub>p uint (i_' s)) = Some v \<and> cpde_relation pde v \<and> (i_' s = 0 \<or> array_assertion ptr (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s))))}}
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); case rv'a of (i', rv') \<Rightarrow> dc rv rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
A total of 16 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (15 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = from_bool (isPageTablePDE rv \<or> isSectionPDE rv)) ret__int_' (\<lambda>a b. UNIV)
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys s s'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> (if pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr) then UNIV else {}) \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>pde. ko_at' pde (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) s \<longrightarrow> True) and (\<lambda>a. True)) s \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. let ptr = pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) in \<exists>v. cslift s (ptr +\<^sub>p uint (i_' s)) = Some v \<and> cpde_relation pde v \<and> (i_' s = 0 \<or> array_assertion ptr (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s))))}}
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); case rv'a of (i', rv') \<Rightarrow> dc rv rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
A total of 15 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (14 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C ys s s'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < length superSectionPDEOffsets; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> (if pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr) then UNIV else {}) \<inter> \<lbrace>\<acute>i = word_of_nat (length ys)\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. \<forall>pde. ko_at' pde (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr) s \<longrightarrow> True) and (\<lambda>a. True)) s \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (superSectionPDEOffsets ! length ys + lookup_pd_slot pd vaddr)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. let ptr = pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) in \<exists>v. cslift s (ptr +\<^sub>p uint (i_' s)) = Some v \<and> cpde_relation pde v \<and> (i_' s = 0 \<or> array_assertion ptr (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s))))}}
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); case rv'a of (i', rv') \<Rightarrow> dc rv rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets)))) (\<lambda>a. (i_' a, xfdc a)) (\<lambda>v. ?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' (theRight v))),UNIV
A total of 14 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (14 subgoals):
 1. \<And>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C ys s s' pde pde'. \<lbrakk>lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; vm_attribs_relation attr attra; vsz = Wellformed_C.ARMSuperSection; pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < 16; (s, s') \<in> rf_sr; page_directory_at' pd s; vmsz_aligned' vaddr Wellformed_C.ARMSuperSection; vmRights < 4; vrights = vmrights_to_H vmRights; pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr); i_' s' = word_of_nat (length ys); vmsz_aligned' base Wellformed_C.ARMSuperSection; is_aligned pd pdBits; cslift s' (pde_Ptr ([0 .e. 0xF] ! length ys * 4 + lookup_pd_slot pd vaddr)) = Some pde'; cpde_relation pde pde'\<rbrakk> \<Longrightarrow> \<exists>v. cslift s' (pde_Ptr (lookup_pd_slot pd vaddr + word_of_nat (length ys) * 4)) = Some v \<and> cpde_relation pde v \<and> (word_of_nat (length ys) = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pd vaddr)) (Suc (unat (word_of_nat (length ys)))) (hrs_htd (t_hrs_' (globals s'))))
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); case rv'a of (i', rv') \<Rightarrow> dc rv rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets)))) (\<lambda>a. (i_' a, xfdc a)) (\<lambda>v. ?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' (theRight v))),UNIV
A total of 14 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (14 subgoals):
 1. \<And>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C ys s s' pde pde'. \<lbrakk>lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; vm_attribs_relation attr attra; vsz = Wellformed_C.ARMSuperSection; pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < 16; (s, s') \<in> rf_sr; page_directory_at' pd s; vmsz_aligned' vaddr Wellformed_C.ARMSuperSection; vmRights < 4; vrights = vmrights_to_H vmRights; pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr); i_' s' = word_of_nat (length ys); vmsz_aligned' base Wellformed_C.ARMSuperSection; is_aligned pd pdBits; cslift s' (pde_Ptr ([0 .e. 0xF] ! length ys * 4 + lookup_pd_slot pd vaddr)) = Some pde'; cpde_relation pde pde'; page_directory_at' pd s \<longrightarrow> vmsz_aligned vaddr Wellformed_C.ARMSuperSection \<longrightarrow> (Suc \<circ> unat \<circ> i_') s' \<le> 16 \<longrightarrow> (Suc \<circ> unat \<circ> i_') s' \<noteq> 0 \<longrightarrow> array_assertion (pde_Ptr (lookup_pd_slot pd vaddr)) ((Suc \<circ> unat \<circ> i_') s') (hrs_htd (t_hrs_' (globals s')))\<rbrakk> \<Longrightarrow> \<exists>v. cslift s' (pde_Ptr (lookup_pd_slot pd vaddr + word_of_nat (length ys) * 4)) = Some v \<and> cpde_relation pde v \<and> (word_of_nat (length ys) = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pd vaddr)) (Suc (unat (word_of_nat (length ys)))) (hrs_htd (t_hrs_' (globals s'))))
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); case rv'a of (i', rv') \<Rightarrow> dc rv rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets)))) (\<lambda>a. (i_' a, xfdc a)) (\<lambda>v. ?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' (theRight v))),UNIV
A total of 14 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (14 subgoals):
 1. \<And>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C ys s s' pde pde'. \<lbrakk>lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; vm_attribs_relation attr attra; vsz = Wellformed_C.ARMSuperSection; pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); length ys < 16; (s, s') \<in> rf_sr; page_directory_at' pd s; vmsz_aligned' vaddr Wellformed_C.ARMSuperSection; vmRights < 4; vrights = vmrights_to_H vmRights; pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr); i_' s' = word_of_nat (length ys); vmsz_aligned' base Wellformed_C.ARMSuperSection; is_aligned pd pdBits; cslift s' (pde_Ptr ([0 .e. 0xF] ! length ys * 4 + lookup_pd_slot pd vaddr)) = Some pde'; cpde_relation pde pde'; page_directory_at' pd s \<longrightarrow> vmsz_aligned vaddr Wellformed_C.ARMSuperSection \<longrightarrow> (Suc \<circ> unat \<circ> i_') s' \<le> 16 \<longrightarrow> (Suc \<circ> unat \<circ> i_') s' \<noteq> 0 \<longrightarrow> array_assertion (pde_Ptr (lookup_pd_slot pd vaddr)) ((Suc \<circ> unat \<circ> i_') s') (hrs_htd (t_hrs_' (globals s')))\<rbrakk> \<Longrightarrow> \<exists>v. cslift s' (pde_Ptr (word_of_nat (length ys) * 4 + lookup_pd_slot pd vaddr)) = Some v \<and> cpde_relation pde v \<and> (word_of_nat (length ys) = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pd vaddr)) (Suc (unat (word_of_nat (length ys)))) (hrs_htd (t_hrs_' (globals s'))))
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); case rv'a of (i', rv') \<Rightarrow> dc rv rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
 10. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets)))) (\<lambda>a. (i_' a, xfdc a)) (\<lambda>v. ?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' (theRight v))),UNIV
A total of 14 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (13 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> (n < 0x10) = (n < word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)))
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); case rv'a of (i', rv') \<Rightarrow> dc rv rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
 9. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets)))) (\<lambda>a. (i_' a, xfdc a)) (\<lambda>v. ?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' (theRight v))),UNIV
 10. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
A total of 13 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (12 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI (\<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace> \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>),UNIV
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); case rv'a of (i', rv') \<Rightarrow> dc rv rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets)))) (\<lambda>a. (i_' a, xfdc a)) (\<lambda>v. ?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' (theRight v))),UNIV
 9. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 10. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and ?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
A total of 12 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (12 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pd vaddr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pd vaddr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pd vaddr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (lookup_pd_slot pd vaddr + \<acute>i * 4)));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pd vaddr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pd vaddr)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pd vaddr + i_' s * 4)} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pd vaddr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_Ptr (lookup_pd_slot pd vaddr + \<acute>i * 4)));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pd vaddr)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>,UNIV
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); case rv'a of (i', rv') \<Rightarrow> dc rv rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets)))) (\<lambda>a. (i_' a, xfdc a)) (\<lambda>v. ?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' (theRight v))),UNIV
 9. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 10. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and ?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
A total of 12 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (12 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrakk> \<Longrightarrow> {s} \<subseteq> {sa. i_' sa = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pd vaddr)) (unat (i_' sa)) (hrs_htd (t_hrs_' (globals sa))) \<longrightarrow> sa \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pd vaddr + i_' sa * 4) \<longrightarrow> i_' sa = 0 \<or> array_assertion (pde_Ptr (lookup_pd_slot pd vaddr)) (Suc (unat (i_' sa))) (hrs_htd (t_hrs_' (globals sa))) \<longrightarrow> (\<forall>t. ret__unsigned_' t = pde_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (pde_Ptr (lookup_pd_slot pd vaddr + i_' sa * 4))) \<longrightarrow> ((if UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (pde_Ptr (lookup_pd_slot pd vaddr + i_' sa * 4)))) \<noteq> pde_pde_invalid then 1 else 0) \<noteq> 0 \<longrightarrow> (if UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (pde_Ptr (lookup_pd_slot pd vaddr + i_' sa * 4)))) \<noteq> pde_pde_section then 1 else 0) = 0 \<longrightarrow> pde_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (pde_Ptr (lookup_pd_slot pd vaddr + i_' sa * 4))) = SCAST(32 signed \<rightarrow> 32) pde_pde_section \<and> (\<forall>t. ret__unsigned_' t = size_CL (pde_pde_section_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (pde_Ptr (lookup_pd_slot pd vaddr + i_' sa * 4)))) \<longrightarrow> (if size_CL (pde_pde_section_lift (h_val (hrs_mem (t_hrs_' (globals sa))) (pde_Ptr (lookup_pd_slot pd vaddr + i_' sa * 4)))) \<noteq> 1 then 1 else 0) = 0 \<longrightarrow> i_' sa = i_' s)) \<and> ((if UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (h_val (hrs_mem (t_hrs_' (globals sa))) (pde_Ptr (lookup_pd_slot pd vaddr + i_' sa * 4)))) \<noteq> pde_pde_invalid then 1 else 0) = 0 \<longrightarrow> i_' sa = i_' s))}
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); case rv'a of (i', rv') \<Rightarrow> dc rv rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
 8. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets)))) (\<lambda>a. (i_' a, xfdc a)) (\<lambda>v. ?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' (theRight v))),UNIV
 9. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 10. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and ?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
A total of 12 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (11 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets)\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets ! n \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); case rv'a of (i', rv') \<Rightarrow> dc rv rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets)))) (\<lambda>a. (i_' a, xfdc a)) (\<lambda>v. ?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' (theRight v))),UNIV
 8. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 9. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and ?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 10. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (11 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C n. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length superSectionPDEOffsets\<rbrakk> \<Longrightarrow> \<lbrace>page_directory_at' pd\<rbrace> liftE (getObject (superSectionPDEOffsets ! n + lookup_pd_slot pd vaddr)) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()) \<lbrace>\<lambda>_. page_directory_at' pd\<rbrace>, -
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); case rv'a of (i', rv') \<Rightarrow> dc rv rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets)))) (\<lambda>a. (i_' a, xfdc a)) (\<lambda>v. ?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' (theRight v))),UNIV
 8. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 9. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and ?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 10. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (11 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C n s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); n < length superSectionPDEOffsets; page_directory_at' pd s\<rbrakk> \<Longrightarrow> True \<and> (\<forall>ko. ko_at' ko (superSectionPDEOffsets ! n + lookup_pd_slot pd vaddr) s \<longrightarrow> (ko = ARM_H.InvalidPDE \<longrightarrow> page_directory_at' pd s) \<and> (\<forall>x xa xb. ko = ARM_H.PageTablePDE x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe xf. ko = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. ko = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> page_directory_at' pd s))
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); case rv'a of (i', rv') \<Rightarrow> dc rv rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
 7. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets)))) (\<lambda>a. (i_' a, xfdc a)) (\<lambda>v. ?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' (theRight v))),UNIV
 8. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 9. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and ?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 10. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (10 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) < 2 ^ word_bits
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); case rv'a of (i', rv') \<Rightarrow> dc rv rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
 6. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets)))) (\<lambda>a. (i_' a, xfdc a)) (\<lambda>v. ?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' (theRight v))),UNIV
 7. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 8. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and ?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 9. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 10. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (page_directory_at' pd and ?R10015 pda attra vmRights frameSize vaddra basea) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})}
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (9 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>s f. xfdc (i_'_update f s) = xfdc s \<and> (i_'_update f s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) = (s \<in> \<lbrace>pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr)\<rbrace>) \<and> (\<forall>s'. ((s', i_'_update f s) \<in> rf_sr) = ((s', s) \<in> rf_sr))
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); case rv'a of (i', rv') \<Rightarrow> dc rv rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
 5. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets)))) (\<lambda>a. (i_' a, xfdc a)) (\<lambda>v. ?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' (theRight v))),UNIV
 6. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 7. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and ?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 8. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 9. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (page_directory_at' pd and ?R10015 pda attra vmRights frameSize vaddra basea) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})}
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (8 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a t t'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (\<lambda>a. (i_' a, xfdc a)) rv'a t t' (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_') (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); case rv'a of (i', rv') \<Rightarrow> dc rv rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (?d'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv'a)
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
 4. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets)))) (\<lambda>a. (i_' a, xfdc a)) (\<lambda>v. ?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' (theRight v))),UNIV
 5. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 6. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and ?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 7. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 8. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (page_directory_at' pd and ?R10015 pda attra vmRights frameSize vaddra basea) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})}
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (7 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); case rv'a of (i', rv') \<Rightarrow> dc rv rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_')
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets)))) (\<lambda>a. (i_' a, xfdc a)) (\<lambda>v. ?Q'10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' (theRight v))),UNIV
 4. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 5. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and ?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 6. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 7. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (page_directory_at' pd and ?R10015 pda attra vmRights frameSize vaddra basea) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})}
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (7 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>); case rv'a of (i', rv') \<Rightarrow> dc rv rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. liftE (getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throwError Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ())) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets))\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv) (?G'20739 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' rv rv'a) [SKIP] (returnOk (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets))) (return_C ret__struct_create_mappings_pde_return_C_'_update (\<lambda>a. create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))))
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>?Q10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<rbrace>, -
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets)))) (\<lambda>a. (i_' a, xfdc a)) (\<lambda>v rv'a. {s. s\<lparr>ret___struct_create_mappings_pde_return_C_' := create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))\<rparr> \<in> ?G'20739 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv' (theRight v) rv'a})),UNIV
 4. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 5. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and ?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 6. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 7. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (page_directory_at' pd and ?R10015 pda attra vmRights frameSize vaddra basea) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})}
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (6 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base\<rbrace> sequenceE (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddr)) superSectionPDEOffsets) \<lbrace>\<lambda>a b. True\<rbrace>, -
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets)))) (\<lambda>a. (i_' a, xfdc a)) (\<lambda>v rv'a. {s. s\<lparr>ret___struct_create_mappings_pde_return_C_' := create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))\<rparr> \<in> \<lbrace>create_mappings_pde_return_C.status_C (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> isRight (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets)) \<and> cpde_relation (fst (theRight (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets)))) (fst (create_mappings_pde_return_C.pde_C (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))), pde_entries_C (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))))) \<and> pde_range_relation (snd (theRight (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets)))) (snd (create_mappings_pde_return_C.pde_C (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))), pde_entries_C (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))))\<rbrace>})),UNIV
 3. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 4. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and ?R10015 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 5. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 6. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (page_directory_at' pd and ?R10015 pda attra vmRights frameSize vaddra basea) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})}
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (5 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C rv'\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C rv') \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD (ccHoarePost (inr_rrel (\<lambda>a aa. case aa of (i', rv') \<Rightarrow> dc a rv' \<and> i' = word_of_nat (length (map ((\<lambda>slot. doE a <- liftE (getObject slot);
case a of ARM_H.InvalidPDE \<Rightarrow> returnOk () | ARM_H.SuperSectionPDE x xa xb xc xd xe \<Rightarrow> returnOk () | _ \<Rightarrow> throwError Fault_H.syscall_error.DeleteFirst
odE) \<circ> (\<lambda>x. x + lookup_pd_slot pd vaddra)) superSectionPDEOffsets)))) (\<lambda>a. (i_' a, xfdc a)) (\<lambda>v rv'a. {s. s\<lparr>ret___struct_create_mappings_pde_return_C_' := create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))\<rparr> \<in> \<lbrace>create_mappings_pde_return_C.status_C (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<and> isRight (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets)) \<and> cpde_relation (fst (theRight (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets)))) (fst (create_mappings_pde_return_C.pde_C (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))), pde_entries_C (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))))) \<and> pde_range_relation (snd (theRight (Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets)))) (snd (create_mappings_pde_return_C.pde_C (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C))), pde_entries_C (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) (pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) ret___struct_create_mappings_pde_return_C)))))\<rbrace>})),UNIV
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 3. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 4. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 5. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (page_directory_at' pd and (\<lambda>a. True)) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})}
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (5 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) ret__struct_pde_C ()\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C ()) \<acute>i :== 0;;
WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD \<lbrace>(\<exists>rv. inr_rrel (\<lambda>a (i', rv'). i' = word_of_nat (length superSectionPDEOffsets)) rv (\<acute>i, 0)) \<longrightarrow> cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights) ret__struct_pde_C \<and> pde_range_relation (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets) (pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C))\<rbrace>,UNIV
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 3. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 4. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 5. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (page_directory_at' pd and (\<lambda>a. True)) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})}
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (6 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) ret__struct_pde_C ()\<^esub> (?R20796 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C) WHILE \<acute>i < 0x10
INV if undefined then UNIV else {}
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD \<lbrace>(\<exists>rv. inr_rrel (\<lambda>a (i', rv'). i' = word_of_nat (length superSectionPDEOffsets)) rv (\<acute>i, 0)) \<longrightarrow> cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights) ret__struct_pde_C \<and> pde_range_relation (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets) (pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C))\<rbrace>,UNIV
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) ret__struct_pde_C ()\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C ()) \<acute>i :== 0 (?R20796 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C),UNIV
 3. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 4. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 5. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 6. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (page_directory_at' pd and (\<lambda>a. True)) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})}
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (6 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) ret__struct_pde_C ()\<^esub> (?R20796 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C) WHILE \<acute>i < 0x10
INV \<lbrace>cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights) ret__struct_pde_C \<and> pde_range_relation (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets) (pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C))\<rbrace>
DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP))
OD \<lbrace>(\<exists>rv. inr_rrel (\<lambda>a b. case b of (i', rv') \<Rightarrow> i' = word_of_nat (length superSectionPDEOffsets)) rv (\<acute>i, 0)) \<longrightarrow> cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights) ret__struct_pde_C \<and> pde_range_relation (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets) (pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C))\<rbrace>,UNIV
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) ret__struct_pde_C ()\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C ()) \<acute>i :== 0 (?R20796 pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C),UNIV
 3. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 4. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 5. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 6. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (page_directory_at' pd and (\<lambda>a. True)) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})}
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (7 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) ret__struct_pde_C ()\<^esub> (\<lbrace>cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights) ret__struct_pde_C \<and> pde_range_relation (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets) (pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C))\<rbrace> \<inter> \<lbrace>\<acute>i < 0x10\<rbrace>) Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_get_pdeType_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>currentPDEType :== UCAST(32 \<rightarrow> 32 signed) \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_invalid then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== (if \<acute>currentPDEType \<noteq> pde_pde_section then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  SKIP
ELSE
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>ret__unsigned :== CALL pde_pde_section_get_size_'proc(h_val (hrs_mem \<acute>t_hrs) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint \<acute>i));;
Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
\<acute>ret__int :== (if \<acute>ret__unsigned \<noteq> 1 then 1 else 0)
FI
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>current_syscall_error :== type_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) seL4_DeleteFirst) \<acute>current_syscall_error;;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)) (pde_C_update (\<lambda>_. ret__struct_pde_C) (create_mappings_pde_return_C.status_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) EXCEPTION_SYSCALL_ERROR) ret___struct_create_mappings_pde_return_C));;
return_C ret__struct_create_mappings_pde_return_C_'_update ret___struct_create_mappings_pde_return_C_'
FI;;
\<acute>i :== \<acute>i + 1;;
Guard ShiftError UNIV (Guard ShiftError UNIV (Guard SignedArithmetic UNIV SKIP)) \<lbrace>cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights) ret__struct_pde_C \<and> pde_range_relation (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets) (pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C))\<rbrace>,UNIV
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights) ret__struct_pde_C \<and> pde_range_relation (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets) (pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C))\<rbrace> \<inter> - \<lbrace>\<acute>i < 0x10\<rbrace> \<subseteq> \<lbrace>(\<exists>rv. inr_rrel (\<lambda>a b. case b of (i', rv') \<Rightarrow> i' = word_of_nat (length superSectionPDEOffsets)) rv (\<acute>i, 0)) \<longrightarrow> cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights) ret__struct_pde_C \<and> pde_range_relation (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets) (pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C))\<rbrace>
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F10006 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) ret__struct_pde_C ()\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C ()) \<acute>i :== 0 \<lbrace>cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights) ret__struct_pde_C \<and> pde_range_relation (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets) (pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C))\<rbrace>,UNIV
 4. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 5. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 6. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 7. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (page_directory_at' pd and (\<lambda>a. True)) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})}
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (7 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights) ret__struct_pde_C \<and> pde_range_relation (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets) (pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C))\<rbrace> \<inter> \<lbrace>\<acute>i < 0x10\<rbrace> \<subseteq> {s. i_' s = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (unat (i_' s)) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> s \<Turnstile>\<^sub>c (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s)) \<longrightarrow> i_' s = 0 \<or> array_assertion (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C)) (Suc (unat (i_' s))) (hrs_htd (t_hrs_' (globals s))) \<longrightarrow> (\<forall>t. ret__unsigned_' t = pde_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))) \<longrightarrow> ((if UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s)))) \<noteq> pde_pde_invalid then 1 else 0) \<noteq> 0 \<longrightarrow> (if UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s)))) \<noteq> pde_pde_section then 1 else 0) = 0 \<longrightarrow> pde_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s))) = SCAST(32 signed \<rightarrow> 32) pde_pde_section \<and> (\<forall>t. ret__unsigned_' t = size_CL (pde_pde_section_lift (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s)))) \<longrightarrow> (if size_CL (pde_pde_section_lift (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s)))) \<noteq> 1 then 1 else 0) = 0 \<longrightarrow> cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights) ret__struct_pde_C \<and> pde_range_relation (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets) (pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C)))) \<and> ((if UCAST(32 \<rightarrow> 32 signed) (pde_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (pde_range_C.base_C (pde_entries_C ret___struct_create_mappings_pde_return_C) +\<^sub>p uint (i_' s)))) \<noteq> pde_pde_invalid then 1 else 0) = 0 \<longrightarrow> cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights) ret__struct_pde_C \<and> pde_range_relation (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets) (pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C))))}
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights) ret__struct_pde_C \<and> pde_range_relation (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets) (pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C))\<rbrace> \<inter> - \<lbrace>\<acute>i < 0x10\<rbrace> \<subseteq> \<lbrace>(\<exists>rv. inr_rrel (\<lambda>a b. case b of (i', rv') \<Rightarrow> i' = word_of_nat (length superSectionPDEOffsets)) rv (\<acute>i, 0)) \<longrightarrow> cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights) ret__struct_pde_C \<and> pde_range_relation (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets) (pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C))\<rbrace>
 3. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C ()) \<acute>i :== 0 \<lbrace>cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights) ret__struct_pde_C \<and> pde_range_relation (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets) (pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C))\<rbrace>,UNIV
 4. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 5. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 6. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 7. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (page_directory_at' pd and (\<lambda>a. True)) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})}
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (6 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<lbrace>cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights) ret__struct_pde_C \<and> pde_range_relation (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets) (pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C))\<rbrace> \<inter> - \<lbrace>\<acute>i < 0x10\<rbrace> \<subseteq> \<lbrace>(\<exists>rv. inr_rrel (\<lambda>a b. case b of (i', rv') \<Rightarrow> i' = word_of_nat (length superSectionPDEOffsets)) rv (\<acute>i, 0)) \<longrightarrow> cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights) ret__struct_pde_C \<and> pde_range_relation (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets) (pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C))\<rbrace>
 2. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C ()) \<acute>i :== 0 \<lbrace>cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights) ret__struct_pde_C \<and> pde_range_relation (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets) (pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C))\<rbrace>,UNIV
 3. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 4. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 5. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 6. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (page_directory_at' pd and (\<lambda>a. True)) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})}
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (5 subgoals):
 1. \<And>pda attra vmRights vaddra basea ret___struct_create_mappings_pde_return_C ret__unsigned unsigned_eret_2 unsigned_eret_3 ret__struct_pde_C. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; ret__unsigned = armParityEnabled_CL (vm_attributes_lift attra); unsigned_eret_2 = armPageCacheable_CL (vm_attributes_lift attra); unsigned_eret_3 = armExecuteNever_CL (vm_attributes_lift attra); pde_lift ret__struct_pde_C = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights vrights, P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C ()) \<acute>i :== 0 \<lbrace>cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights) ret__struct_pde_C \<and> pde_range_relation (map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets) (pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C ret___struct_create_mappings_pde_return_C))\<rbrace>,UNIV
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> ?R'10011 pda attra vmRights vaddra basea (ret___struct_create_mappings_pde_return_C_' s) v va vb vc}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 3. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 4. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 5. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (page_directory_at' pd and (\<lambda>a. True)) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})}
flex-flex pairs:
\<lambda>attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C. ?R'10013 attra vmRights ret___struct_create_mappings_pde_return_C ret__struct_pde_C () \<equiv>\<^sup>? \<lambda>attra vmRights ret___struct_create_mappings_pde_return_C. ?R'10011 (pde_Ptr pd) attra vmRights vaddr base ret___struct_create_mappings_pde_return_C (armParityEnabled_CL (vm_attributes_lift attra)) (armPageCacheable_CL (vm_attributes_lift attra)) (armExecuteNever_CL (vm_attributes_lift attra)) proof (prove)
goal (4 subgoals):
 1. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C ({s. s \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 2 ^ unat (ARMSuperSectionBits - ARMSectionBits)) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> {sa. \<forall>v. v = armParityEnabled_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_' := v\<rparr> \<in> {sa. \<forall>va. va = armPageCacheable_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_2_' := va\<rparr> \<in> {sa. \<forall>vb. vb = armExecuteNever_CL (vm_attributes_lift (vm_attributes_' (vm_attributes_'_update (\<lambda>_. attra) sa))) \<longrightarrow> sa\<lparr>unsigned_eret_3_' := vb\<rparr> \<in> {sa. \<forall>vc v'. pde_lift vc = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), size_CL = if page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa)))))))), AP_CL = ap_from_vm_rights (vmrights_to_H (vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))), P_CL = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), Domain_CL = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), XN_CL = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))), C_CL = 0, B_CL = iwb_from_cacheable (cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) sa))))))))\<rparr>) \<longrightarrow> sa\<lparr>ret__struct_pde_C_' := vc\<rparr> \<in> {sa. sa \<in> {sa. sa \<in> {sa. sa\<lparr>ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (\<lambda>_. pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C (ret___struct_create_mappings_pde_return_C_' s))) (pde_C_update (\<lambda>_. vc) (ret___struct_create_mappings_pde_return_C_' s))\<rparr> \<in> {sa. sa \<in> \<lbrace>pde_range_C.base_C (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddra)\<rbrace> \<inter> {s. dc [] (xfdc s)}} \<inter> \<lbrace>cpde_relation (ARM_H.SuperSectionPDE basea (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights) vc \<and> pde_range_relation (map (\<lambda>x. x + lookup_pd_slot pd vaddra) superSectionPDEOffsets) (pde_range_C.length_C_update (\<lambda>_. 0x10) (pde_entries_C \<^bsup>s\<^esup>ret___struct_create_mappings_pde_return_C))\<rbrace>}}}} \<inter> {s. (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection \<or> page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) = SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<and> vm_rights_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) < 4 \<and> vmsz_aligned' (paddr_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))) (gen_framesize_to_H (page_size_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))))) \<and> parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = parity_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 0xF = domain_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = cacheable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) \<and> nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s))))))) && 1 = nonexecutable_' (vm_rights_'_update (\<lambda>_. vmRights) (domain_'_update (\<lambda>_. 0) (nonexecutable_'_update (\<lambda>_. vb) (cacheable_'_update (\<lambda>_. va) (parity_'_update (\<lambda>_. v) (paddr_'_update (\<lambda>_. base) (page_size_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) s)))))))}}}}}} \<inter> \<lbrace>- 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647\<rbrace> \<inter> \<lbrace>ARMSuperSectionBits - ARMSectionBits <s 0x20\<rbrace> \<inter> \<lbrace>0 \<le>s ARMSuperSectionBits - ARMSectionBits\<rbrace>)
 2. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 3. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 4. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (page_directory_at' pd and (\<lambda>a. True)) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})} proof (prove)
goal (4 subgoals):
 1. \<And>attra vmRights. \<lbrakk>lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; vm_attribs_relation attr attra; vsz = Wellformed_C.ARMSuperSection; vmsz_aligned' vaddr Wellformed_C.ARMSuperSection; vmRights < 4; vrights = vmrights_to_H vmRights; vmsz_aligned' base Wellformed_C.ARMSuperSection; is_aligned pd pdBits\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C (\<lbrace>(\<forall>v. pde_lift v = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>) \<longrightarrow> pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C) = pde_Ptr (lookup_pd_slot pd vaddr) \<and> cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights)) v \<and> map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets = map ptr_val (ptr_range_to_list (pde_range_C.base_C (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) 0x10)) \<and> vmsz_aligned' base (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection)) \<and> armParityEnabled_CL (vm_attributes_lift attra) && 1 = armParityEnabled_CL (vm_attributes_lift attra) \<and> armPageCacheable_CL (vm_attributes_lift attra) && 1 = armPageCacheable_CL (vm_attributes_lift attra) \<and> armExecuteNever_CL (vm_attributes_lift attra) && 1 = armExecuteNever_CL (vm_attributes_lift attra)\<rbrace> \<inter> (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) \<inter> (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) \<inter> (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}))
 2. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?S7776 (pde_Ptr pd) attra vmRights (framesize_from_H Wellformed_C.ARMSuperSection) vaddr base \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 3. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 4. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (page_directory_at' pd and (\<lambda>a. True)) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?S7776 pda attra vmRights frameSize vaddra basea) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})} proof (prove)
goal (3 subgoals):
 1. \<And>pda attra vmRights vaddra basea s. \<lbrakk>vmsz_aligned' vaddr Wellformed_C.ARMSuperSection \<and> vmsz_aligned' base Wellformed_C.ARMSuperSection \<and> is_aligned pd pdBits; lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vaddra = vaddr; basea = base; vsz = Wellformed_C.ARMSuperSection; (page_directory_at' pd and (\<lambda>a. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. array_assertion (pde_Ptr pd) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s))) \<and> (\<forall>t. ret__ptr_to_struct_pde_C_' t = pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr) \<longrightarrow> (\<forall>v. pde_lift v = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>) \<longrightarrow> pde_range_C.base_C (pde_entries_C (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s))) = pde_Ptr (lookup_pd_slot pd vaddr) \<and> cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights)) v \<and> map (\<lambda>x. x + lookup_pd_slot pd vaddr) superSectionPDEOffsets = map ptr_val (ptr_range_to_list (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)))) 0x10)) \<and> vmsz_aligned' base (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection)) \<and> armParityEnabled_CL (vm_attributes_lift attra) && 1 = armParityEnabled_CL (vm_attributes_lift attra) \<and> armPageCacheable_CL (vm_attributes_lift attra) && 1 = armPageCacheable_CL (vm_attributes_lift attra) \<and> armExecuteNever_CL (vm_attributes_lift attra) && 1 = armExecuteNever_CL (vm_attributes_lift attra) \<and> s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr), ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) \<and> s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr), ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) \<and> s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr), ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val (pde_Ptr pd)) vaddr))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}))} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
\<acute>ret___struct_create_mappings_pde_return_C :== pde_entries_C_update (\<lambda>_. pde_range_C.base_C_update (\<lambda>_. \<acute>ret__ptr_to_struct_pde_C) (pde_entries_C \<acute>ret___struct_create_mappings_pde_return_C)) \<acute>ret___struct_create_mappings_pde_return_C {s'. (s, s') \<in> rf_sr}
 2. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 3. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (page_directory_at' pd and (\<lambda>a. True)) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> {s. array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s))) \<and> (\<forall>t. ret__ptr_to_struct_pde_C_' t = pde_Ptr (lookupPDSlot (ptr_val pda) vaddra) \<longrightarrow> (\<forall>v. pde_lift v = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = basea, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>) \<longrightarrow> pde_range_C.base_C (pde_entries_C (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val pda) vaddra))) (ret___struct_create_mappings_pde_return_C_' s))) = pde_Ptr (lookup_pd_slot pd vaddra) \<and> cpde_relation (ARM_H.SuperSectionPDE basea (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights)) v \<and> map (\<lambda>x. x + lookup_pd_slot pd vaddra) superSectionPDEOffsets = map ptr_val (ptr_range_to_list (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val pda) vaddra))) (ret___struct_create_mappings_pde_return_C_' s)))) 0x10)) \<and> vmsz_aligned' basea (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection)) \<and> armParityEnabled_CL (vm_attributes_lift attra) && 1 = armParityEnabled_CL (vm_attributes_lift attra) \<and> armPageCacheable_CL (vm_attributes_lift attra) && 1 = armPageCacheable_CL (vm_attributes_lift attra) \<and> armExecuteNever_CL (vm_attributes_lift attra) && 1 = armExecuteNever_CL (vm_attributes_lift attra) \<and> s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val pda) vaddra), ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val pda) vaddra))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) \<and> s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val pda) vaddra), ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val pda) vaddra))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) \<and> s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val pda) vaddra), ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val pda) vaddra))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}))}) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})} proof (prove)
goal (2 subgoals):
 1. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (?R7772 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) (?T7774 (pde_Ptr pd) attra vmRights (framesize_from_H vsz) vaddr base) [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 2. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (page_directory_at' pd and (\<lambda>a. True)) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> ?R7772 pda attra vmRights frameSize vaddra basea s))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> {s. array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s))) \<and> (\<forall>t. ret__ptr_to_struct_pde_C_' t = pde_Ptr (lookupPDSlot (ptr_val pda) vaddra) \<longrightarrow> (\<forall>v. pde_lift v = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = basea, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>) \<longrightarrow> pde_range_C.base_C (pde_entries_C (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val pda) vaddra))) (ret___struct_create_mappings_pde_return_C_' s))) = pde_Ptr (lookup_pd_slot pd vaddra) \<and> cpde_relation (ARM_H.SuperSectionPDE basea (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights)) v \<and> map (\<lambda>x. x + lookup_pd_slot pd vaddra) superSectionPDEOffsets = map ptr_val (ptr_range_to_list (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val pda) vaddra))) (ret___struct_create_mappings_pde_return_C_' s)))) 0x10)) \<and> vmsz_aligned' basea (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection)) \<and> armParityEnabled_CL (vm_attributes_lift attra) && 1 = armParityEnabled_CL (vm_attributes_lift attra) \<and> armPageCacheable_CL (vm_attributes_lift attra) && 1 = armPageCacheable_CL (vm_attributes_lift attra) \<and> armExecuteNever_CL (vm_attributes_lift attra) && 1 = armExecuteNever_CL (vm_attributes_lift attra) \<and> s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val pda) vaddra), ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val pda) vaddra))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) \<and> s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val pda) vaddra), ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val pda) vaddra))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) \<and> s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val pda) vaddra), ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val pda) vaddra))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}))}) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> ?T7774 pda attra vmRights frameSize vaddra basea)})} proof (prove)
goal (2 subgoals):
 1. \<And>pda attra vmRights vaddra basea. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; vaddra = vaddr; basea = base; vsz \<noteq> Wellformed_C.ARMSection; vsz \<noteq> Wellformed_C.ARMSuperSection\<rbrakk> \<Longrightarrow> ccorres (syscall_error_rel \<currency> (\<lambda>rv rv'. isRight rv \<and> cpde_relation (fst (theRight rv)) (fst rv') \<and> pde_range_relation (snd (theRight rv)) (snd rv'))) (liftxf errstate create_mappings_pde_return_C.status_C (\<lambda>v. (create_mappings_pde_return_C.pde_C v, pde_entries_C v)) ret__struct_create_mappings_pde_return_C_') (\<lambda>_. True) UNIV [SKIP] (doE entries <- case vsz of local.ARMSmallPage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.SmallPagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMLargePage \<Rightarrow> doE p <- lookupErrorOnFailure False $ lookupPTSlot pd vaddr;
returnOk $ Inl (ARM_H.LargePagePTE base (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) largePagePTEOffsets)
odE | local.ARMSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SectionPDE base (armParityEnabled attr) 0 (armPageCacheable attr) False (armExecuteNever attr) vrights, [p])
odE | local.ARMSuperSection \<Rightarrow> doE p <- returnOk (lookupPDSlot pd vaddr);
returnOk $ Inr (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) vrights, map (\<lambda>x. x + p) superSectionPDEOffsets)
odE;
y <- case entries of Inl (ARM_H.InvalidPTE, xa) \<Rightarrow> returnOk () | Inl (ARM_H.LargePagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>x xa xb xc xd. returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inl (ARM_H.SmallPagePTE xaa xab xb xc xd, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pte (returnOk ()) (\<lambda>word bool1 bool2 bool3 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd. returnOk ())) | Inr (ARM_H.InvalidPDE, xa) \<Rightarrow> returnOk () | Inr (ARM_H.PageTablePDE x xaa xb, xa) \<Rightarrow> haskell_fail [] | Inr (ARM_H.SectionPDE xaa xab xb xc xd xe xf, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe xf. returnOk ()) (\<lambda>word bool1 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst)) | Inr (ARM_H.SuperSectionPDE xaa xab xb xc xd xe, xa) \<Rightarrow> forME_x xa (\<lambda>slot. (withoutFailure $ getObject slot) >>=E ARM_H.case_pde (returnOk ()) (\<lambda>word1 bool word2. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>word1 bool1 word2 bool2 bool3 bool4 vmrights. throw Fault_H.syscall_error.DeleteFirst) (\<lambda>x xa xb xc xd xe. returnOk ()));
returnOk entries
odE) (Guard DontReach {} SKIP)
 2. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (page_directory_at' pd and (\<lambda>a. True)) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> True))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> {s. array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s))) \<and> (\<forall>t. ret__ptr_to_struct_pde_C_' t = pde_Ptr (lookupPDSlot (ptr_val pda) vaddra) \<longrightarrow> (\<forall>v. pde_lift v = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = basea, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>) \<longrightarrow> pde_range_C.base_C (pde_entries_C (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val pda) vaddra))) (ret___struct_create_mappings_pde_return_C_' s))) = pde_Ptr (lookup_pd_slot pd vaddra) \<and> cpde_relation (ARM_H.SuperSectionPDE basea (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights)) v \<and> map (\<lambda>x. x + lookup_pd_slot pd vaddra) superSectionPDEOffsets = map ptr_val (ptr_range_to_list (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val pda) vaddra))) (ret___struct_create_mappings_pde_return_C_' s)))) 0x10)) \<and> vmsz_aligned' basea (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection)) \<and> armParityEnabled_CL (vm_attributes_lift attra) && 1 = armParityEnabled_CL (vm_attributes_lift attra) \<and> armPageCacheable_CL (vm_attributes_lift attra) && 1 = armPageCacheable_CL (vm_attributes_lift attra) \<and> armExecuteNever_CL (vm_attributes_lift attra) && 1 = armExecuteNever_CL (vm_attributes_lift attra) \<and> s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val pda) vaddra), ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val pda) vaddra))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) \<and> s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val pda) vaddra), ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val pda) vaddra))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) \<and> s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val pda) vaddra), ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val pda) vaddra))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}))}) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> UNIV)})} proof (prove)
goal (1 subgoal):
 1. \<And>pda attra vmRights frameSize vaddra basea s s'. \<lbrakk>vmsz_aligned' vaddr vsz \<and> vmsz_aligned' base vsz \<and> is_aligned pd pdBits; vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; pda = pde_Ptr pd; vm_attribs_relation attr attra; vmrights_to_H vmRights = vrights \<and> vmRights < 4; frameSize = framesize_from_H vsz \<and> (vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection); vaddra = vaddr; basea = base; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((vsz = Wellformed_C.ARMSection \<longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> True)) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> (page_directory_at' pd and (\<lambda>a. True)) s) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> True))) \<and> s' \<in> {s. (vsz = Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s)))}}) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> s \<in> {s. (vsz = Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> {s. array_assertion pda (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s))) \<and> (\<forall>t. ret__ptr_to_struct_pde_C_' t = pde_Ptr (lookupPDSlot (ptr_val pda) vaddra) \<longrightarrow> (\<forall>v. pde_lift v = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = basea, size_CL = if Kernel_C.ARMSuperSection = Kernel_C.ARMSection then 0 else 1, nG_CL = 1, S_CL = shared_bit_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), APX_CL = 0, TEX_CL = tex_bits_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra)), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = armParityEnabled_CL (vm_attributes_lift attra), Domain_CL = 0, XN_CL = armExecuteNever_CL (vm_attributes_lift attra), C_CL = 0, B_CL = iwb_from_cacheable (armPageCacheable_CL (vm_attributes_lift attra))\<rparr>) \<longrightarrow> pde_range_C.base_C (pde_entries_C (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val pda) vaddra))) (ret___struct_create_mappings_pde_return_C_' s))) = pde_Ptr (lookup_pd_slot pd vaddra) \<and> cpde_relation (ARM_H.SuperSectionPDE basea (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights)) v \<and> map (\<lambda>x. x + lookup_pd_slot pd vaddra) superSectionPDEOffsets = map ptr_val (ptr_range_to_list (pde_range_C.base_C (pde_entries_C (pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val pda) vaddra))) (ret___struct_create_mappings_pde_return_C_' s)))) 0x10)) \<and> vmsz_aligned' basea (gen_framesize_to_H (SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection)) \<and> armParityEnabled_CL (vm_attributes_lift attra) && 1 = armParityEnabled_CL (vm_attributes_lift attra) \<and> armPageCacheable_CL (vm_attributes_lift attra) && 1 = armPageCacheable_CL (vm_attributes_lift attra) \<and> armExecuteNever_CL (vm_attributes_lift attra) && 1 = armExecuteNever_CL (vm_attributes_lift attra) \<and> s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val pda) vaddra), ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val pda) vaddra))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> (if - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 then UNIV else {}) \<and> s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val pda) vaddra), ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val pda) vaddra))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> (if ARMSuperSectionBits - ARMSectionBits <s 0x20 then UNIV else {}) \<and> s\<lparr>ret__ptr_to_struct_pde_C_' := pde_Ptr (lookupPDSlot (ptr_val pda) vaddra), ret___struct_create_mappings_pde_return_C_' := pde_entries_C_update (pde_range_C.base_C_update (\<lambda>v. pde_Ptr (lookupPDSlot (ptr_val pda) vaddra))) (ret___struct_create_mappings_pde_return_C_' s)\<rparr> \<in> (if 0 \<le>s ARMSuperSectionBits - ARMSectionBits then UNIV else {}))}) \<and> (vsz \<noteq> Wellformed_C.ARMSuperSection \<longrightarrow> s \<in> UNIV)})} proof (prove)
goal (1 subgoal):
 1. \<And>attra vmRights s s'. \<lbrakk>vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; (s, s') \<in> rf_sr; page_directory_at' pd s; is_aligned vaddr (pageBitsForSize vsz); armParityEnabled_CL (vm_attributes_lift attra) = from_bool (armParityEnabled attr); vmRights < 4; vrights = vmrights_to_H vmRights; is_aligned base (pageBitsForSize vsz); is_aligned pd pdBits; armPageCacheable_CL (vm_attributes_lift attra) = from_bool (armPageCacheable attr); armExecuteNever_CL (vm_attributes_lift attra) = from_bool (armExecuteNever attr)\<rbrakk> \<Longrightarrow> (vsz = Wellformed_C.ARMSection \<longrightarrow> (\<exists>pde pde'. cslift s' (pde_Ptr (lookup_pd_slot pd vaddr)) = Some pde' \<and> cpde_relation pde pde') \<longrightarrow> array_assertion (pde_Ptr pd) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s')))) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> vsz = Wellformed_C.ARMSuperSection \<longrightarrow> array_assertion (pde_Ptr pd) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s'))) \<and> ((\<exists>t. ret__ptr_to_struct_pde_C_' t = pde_Ptr (lookup_pd_slot pd vaddr)) \<longrightarrow> (\<forall>v. pde_lift v = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = 1, nG_CL = 1, S_CL = s_from_cacheable (armPageCacheable attr), APX_CL = 0, TEX_CL = tex_from_cacheable (armPageCacheable attr), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = from_bool (armParityEnabled attr), Domain_CL = 0, XN_CL = from_bool (armExecuteNever attr), C_CL = 0, B_CL = b_from_cacheable (armPageCacheable attr)\<rparr>) \<longrightarrow> cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights)) v \<and> map ((\<lambda>x. x + lookup_pd_slot pd vaddr) \<circ> ((\<lambda>x. x * 4) \<circ> word_of_nat)) [0..<15] @ [0x3C + lookup_pd_slot pd vaddr] = map (ptr_val \<circ> (\<lambda>x. pde_Ptr (lookup_pd_slot pd vaddr + word_of_nat x * 4))) [0..<16]) \<and> is_aligned base 24 \<and> - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 \<and> ARMSuperSectionBits - ARMSectionBits <s 0x20 \<and> 0 \<le>s ARMSuperSectionBits - ARMSectionBits)) proof (prove)
goal (1 subgoal):
 1. \<And>attra vmRights s s' y. \<lbrakk>vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; (s, s') \<in> rf_sr; page_directory_at' pd s; is_aligned vaddr (pageBitsForSize vsz); armParityEnabled_CL (vm_attributes_lift attra) = from_bool (armParityEnabled attr); vmRights < 4; vrights = vmrights_to_H vmRights; is_aligned base (pageBitsForSize vsz); is_aligned pd pdBits; armPageCacheable_CL (vm_attributes_lift attra) = from_bool (armPageCacheable attr); armExecuteNever_CL (vm_attributes_lift attra) = from_bool (armExecuteNever attr); cslift s' (pd_Ptr pd) = Some y\<rbrakk> \<Longrightarrow> (vsz = Wellformed_C.ARMSection \<longrightarrow> (\<exists>pde pde'. cslift s' (pde_Ptr (lookup_pd_slot pd vaddr)) = Some pde' \<and> cpde_relation pde pde') \<longrightarrow> array_assertion (pde_Ptr pd) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s')))) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> vsz = Wellformed_C.ARMSuperSection \<longrightarrow> array_assertion (pde_Ptr pd) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s'))) \<and> ((\<exists>t. ret__ptr_to_struct_pde_C_' t = pde_Ptr (lookup_pd_slot pd vaddr)) \<longrightarrow> (\<forall>v. pde_lift v = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = 1, nG_CL = 1, S_CL = s_from_cacheable (armPageCacheable attr), APX_CL = 0, TEX_CL = tex_from_cacheable (armPageCacheable attr), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = from_bool (armParityEnabled attr), Domain_CL = 0, XN_CL = from_bool (armExecuteNever attr), C_CL = 0, B_CL = b_from_cacheable (armPageCacheable attr)\<rparr>) \<longrightarrow> cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights)) v \<and> map ((\<lambda>x. x + lookup_pd_slot pd vaddr) \<circ> ((\<lambda>x. x * 4) \<circ> word_of_nat)) [0..<15] @ [0x3C + lookup_pd_slot pd vaddr] = map (ptr_val \<circ> (\<lambda>x. pde_Ptr (lookup_pd_slot pd vaddr + word_of_nat x * 4))) [0..<16]) \<and> is_aligned base 24 \<and> - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 \<and> ARMSuperSectionBits - ARMSectionBits <s 0x20 \<and> 0 \<le>s ARMSuperSectionBits - ARMSectionBits)) proof (prove)
goal (1 subgoal):
 1. \<And>attra vmRights s s' y. \<lbrakk>vsz = Wellformed_C.ARMSuperSection \<longrightarrow> lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; vsz = Wellformed_C.ARMSection \<or> vsz = Wellformed_C.ARMSuperSection; (s, s') \<in> rf_sr; page_directory_at' pd s; is_aligned vaddr (pageBitsForSize vsz); armParityEnabled_CL (vm_attributes_lift attra) = from_bool (armParityEnabled attr); vmRights < 4; vrights = vmrights_to_H vmRights; is_aligned base (pageBitsForSize vsz); is_aligned pd pdBits; armPageCacheable_CL (vm_attributes_lift attra) = from_bool (armPageCacheable attr); armExecuteNever_CL (vm_attributes_lift attra) = from_bool (armExecuteNever attr); cslift s' (pd_Ptr pd) = Some y; array_assertion (PTR_COERCE(pde_C[4096] \<rightarrow> pde_C) (pd_Ptr pd)) CARD(4096) (hrs_htd (t_hrs_' (globals s')))\<rbrakk> \<Longrightarrow> (vsz = Wellformed_C.ARMSection \<longrightarrow> (\<exists>pde pde'. cslift s' (pde_Ptr (lookup_pd_slot pd vaddr)) = Some pde' \<and> cpde_relation pde pde') \<longrightarrow> array_assertion (pde_Ptr pd) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s')))) \<and> (vsz \<noteq> Wellformed_C.ARMSection \<longrightarrow> vsz = Wellformed_C.ARMSuperSection \<longrightarrow> array_assertion (pde_Ptr pd) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s'))) \<and> ((\<exists>t. ret__ptr_to_struct_pde_C_' t = pde_Ptr (lookup_pd_slot pd vaddr)) \<longrightarrow> (\<forall>v. pde_lift v = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = 1, nG_CL = 1, S_CL = s_from_cacheable (armPageCacheable attr), APX_CL = 0, TEX_CL = tex_from_cacheable (armPageCacheable attr), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = from_bool (armParityEnabled attr), Domain_CL = 0, XN_CL = from_bool (armExecuteNever attr), C_CL = 0, B_CL = b_from_cacheable (armPageCacheable attr)\<rparr>) \<longrightarrow> cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights)) v \<and> map ((\<lambda>x. x + lookup_pd_slot pd vaddr) \<circ> ((\<lambda>x. x * 4) \<circ> word_of_nat)) [0..<15] @ [0x3C + lookup_pd_slot pd vaddr] = map (ptr_val \<circ> (\<lambda>x. pde_Ptr (lookup_pd_slot pd vaddr + word_of_nat x * 4))) [0..<16]) \<and> is_aligned base 24 \<and> - 2147483648 \<le> sint ARMSuperSectionBits - sint ARMSectionBits \<and> sint ARMSuperSectionBits - sint ARMSectionBits \<le> 2147483647 \<and> ARMSuperSectionBits - ARMSectionBits <s 0x20 \<and> 0 \<le>s ARMSuperSectionBits - ARMSectionBits)) proof (prove)
goal (1 subgoal):
 1. \<And>attra vmRights s s' y t v. \<lbrakk>lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; (s, s') \<in> rf_sr; page_directory_at' pd s; is_aligned vaddr 24; armParityEnabled_CL (vm_attributes_lift attra) = from_bool (armParityEnabled attr); vmRights < 4; vrights = vmrights_to_H vmRights; is_aligned base 24; is_aligned pd pdBits; armPageCacheable_CL (vm_attributes_lift attra) = from_bool (armPageCacheable attr); armExecuteNever_CL (vm_attributes_lift attra) = from_bool (armExecuteNever attr); cslift s' (pd_Ptr pd) = Some y; array_assertion (pde_Ptr pd) 4096 (hrs_htd (t_hrs_' (globals s'))); vsz = Wellformed_C.ARMSuperSection; ret__ptr_to_struct_pde_C_' t = pde_Ptr (lookup_pd_slot pd vaddr); pde_lift v = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = 1, nG_CL = 1, S_CL = s_from_cacheable (armPageCacheable attr), APX_CL = 0, TEX_CL = tex_from_cacheable (armPageCacheable attr), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = from_bool (armParityEnabled attr), Domain_CL = 0, XN_CL = from_bool (armExecuteNever attr), C_CL = 0, B_CL = b_from_cacheable (armPageCacheable attr)\<rparr>)\<rbrakk> \<Longrightarrow> cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights)) v \<and> map ((\<lambda>x. x + lookup_pd_slot pd vaddr) \<circ> ((\<lambda>x. x * 4) \<circ> word_of_nat)) [0..<15] @ [0x3C + lookup_pd_slot pd vaddr] = map (ptr_val \<circ> (\<lambda>x. pde_Ptr (lookup_pd_slot pd vaddr + word_of_nat x * 4))) [0..<16] proof (prove)
goal (2 subgoals):
 1. \<And>attra vmRights s s' y t v. \<lbrakk>lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; (s, s') \<in> rf_sr; page_directory_at' pd s; is_aligned vaddr 24; armParityEnabled_CL (vm_attributes_lift attra) = from_bool (armParityEnabled attr); vmRights < 4; vrights = vmrights_to_H vmRights; is_aligned base 24; is_aligned pd pdBits; armPageCacheable_CL (vm_attributes_lift attra) = from_bool (armPageCacheable attr); armExecuteNever_CL (vm_attributes_lift attra) = from_bool (armExecuteNever attr); cslift s' (pd_Ptr pd) = Some y; array_assertion (pde_Ptr pd) 4096 (hrs_htd (t_hrs_' (globals s'))); vsz = Wellformed_C.ARMSuperSection; ret__ptr_to_struct_pde_C_' t = pde_Ptr (lookup_pd_slot pd vaddr); pde_lift v = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = 1, nG_CL = 1, S_CL = s_from_cacheable (armPageCacheable attr), APX_CL = 0, TEX_CL = tex_from_cacheable (armPageCacheable attr), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = from_bool (armParityEnabled attr), Domain_CL = 0, XN_CL = from_bool (armExecuteNever attr), C_CL = 0, B_CL = b_from_cacheable (armPageCacheable attr)\<rparr>)\<rbrakk> \<Longrightarrow> cpde_relation (ARM_H.SuperSectionPDE base (armParityEnabled attr) (armPageCacheable attr) False (armExecuteNever attr) (vmrights_to_H vmRights)) v
 2. \<And>attra vmRights s s' y t v. \<lbrakk>lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; (s, s') \<in> rf_sr; page_directory_at' pd s; is_aligned vaddr 24; armParityEnabled_CL (vm_attributes_lift attra) = from_bool (armParityEnabled attr); vmRights < 4; vrights = vmrights_to_H vmRights; is_aligned base 24; is_aligned pd pdBits; armPageCacheable_CL (vm_attributes_lift attra) = from_bool (armPageCacheable attr); armExecuteNever_CL (vm_attributes_lift attra) = from_bool (armExecuteNever attr); cslift s' (pd_Ptr pd) = Some y; array_assertion (pde_Ptr pd) 4096 (hrs_htd (t_hrs_' (globals s'))); vsz = Wellformed_C.ARMSuperSection; ret__ptr_to_struct_pde_C_' t = pde_Ptr (lookup_pd_slot pd vaddr); pde_lift v = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = 1, nG_CL = 1, S_CL = s_from_cacheable (armPageCacheable attr), APX_CL = 0, TEX_CL = tex_from_cacheable (armPageCacheable attr), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = from_bool (armParityEnabled attr), Domain_CL = 0, XN_CL = from_bool (armExecuteNever attr), C_CL = 0, B_CL = b_from_cacheable (armPageCacheable attr)\<rparr>)\<rbrakk> \<Longrightarrow> map ((\<lambda>x. x + lookup_pd_slot pd vaddr) \<circ> ((\<lambda>x. x * 4) \<circ> word_of_nat)) [0..<15] @ [0x3C + lookup_pd_slot pd vaddr] = map (ptr_val \<circ> (\<lambda>x. pde_Ptr (lookup_pd_slot pd vaddr + word_of_nat x * 4))) [0..<16] proof (prove)
goal (1 subgoal):
 1. \<And>attra vmRights s s' y t v. \<lbrakk>lookup_pd_slot pd vaddr \<le> lookup_pd_slot pd vaddr + 0x3C; (s, s') \<in> rf_sr; page_directory_at' pd s; is_aligned vaddr 24; armParityEnabled_CL (vm_attributes_lift attra) = from_bool (armParityEnabled attr); vmRights < 4; vrights = vmrights_to_H vmRights; is_aligned base 24; is_aligned pd pdBits; armPageCacheable_CL (vm_attributes_lift attra) = from_bool (armPageCacheable attr); armExecuteNever_CL (vm_attributes_lift attra) = from_bool (armExecuteNever attr); cslift s' (pd_Ptr pd) = Some y; array_assertion (pde_Ptr pd) 4096 (hrs_htd (t_hrs_' (globals s'))); vsz = Wellformed_C.ARMSuperSection; ret__ptr_to_struct_pde_C_' t = pde_Ptr (lookup_pd_slot pd vaddr); pde_lift v = Some (Pde_pde_section \<lparr>pde_pde_section_CL.address_CL = base, size_CL = 1, nG_CL = 1, S_CL = s_from_cacheable (armPageCacheable attr), APX_CL = 0, TEX_CL = tex_from_cacheable (armPageCacheable attr), AP_CL = ap_from_vm_rights (vmrights_to_H vmRights), P_CL = from_bool (armParityEnabled attr), Domain_CL = 0, XN_CL = from_bool (armExecuteNever attr), C_CL = 0, B_CL = b_from_cacheable (armPageCacheable attr)\<rparr>)\<rbrakk> \<Longrightarrow> map ((\<lambda>x. x + lookup_pd_slot pd vaddr) \<circ> ((\<lambda>x. x * 4) \<circ> word_of_nat)) [0..<15] @ [0x3C + lookup_pd_slot pd vaddr] = map (ptr_val \<circ> (\<lambda>x. pde_Ptr (lookup_pd_slot pd vaddr + word_of_nat x * 4))) [0..<16] proof (prove)
goal:
No subgoals!