theory Arch_C

lemma resolveVAddr_ccorres:
  "ccorres resolve_ret_rel ret__struct_resolve_ret_C_'
     (page_directory_at' pd) (UNIV \<inter> {s. pd_' s = pde_Ptr pd} \<inter> {s. vaddr_' s = vaddr}) hs
     (resolveVAddr pd vaddr) (Call resolveVAddr_'proc)" apply (cinit lift: pd_' vaddr_') apply clarsimp apply (rule ccorres_pre_getObject_pde) apply csymbr+ apply (rule ccorres_abstract_cleanup) apply (rule_tac P="(ret__unsigned = scast pde_pde_coarse) = (isPageTablePDE rv)"
               in ccorres_gen_asm2) apply (rule_tac P="isPageTablePDE rv" in ccorres_cases) apply (clarsimp simp: pde_tag_defs) apply wpc apply (rule ccorres_inst[where P=\<top> and P'=UNIV]) apply (clarsimp simp: isPageTablePDE_def split: pde.splits) prefer 2 apply (rule ccorres_inst[where P=\<top> and P'=UNIV]) apply (clarsimp simp: isPageTablePDE_def split: pde.splits) prefer 2 apply (rule ccorres_inst[where P=\<top> and P'=UNIV]) apply (clarsimp simp: isPageTablePDE_def split: pde.splits) apply (rename_tac word1 bool word2) apply (rule ccorres_rhs_assoc)+ apply csymbr apply (rule ccorres_abstract_cleanup) apply (rule_tac P="(ret__unsigned = word1)" in ccorres_gen_asm2) apply (rule ccorres_stateAssert) apply (rule_tac val="Ptr (ptrFromPAddr word1)" and R=\<top>
                  in ccorres_symb_exec_r_known_rv_UNIV[where xf'=ret__ptr_to_void_' and R'=UNIV]) apply (vcg, clarsimp) apply ceqv apply (rule ccorres_pre_getObject_pte) apply (rule_tac P="page_table_at' (ptrFromPAddr word1)"
       in ccorres_cross_over_guard) apply (rule_tac P'="{s. \<exists>v. cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr)) = Some v
                                    \<and> cpte_relation rva v
                                    \<and> array_assertion (pte_Ptr (ptrFromPAddr word1))
                                        (2 ^ (ptBits - 2)) (hrs_htd (t_hrs_' (globals s)))}"
                  in ccorres_from_vcg_might_throw[where P=\<top>]) apply (rule allI, rule conseqPre, vcg) using pte_get_tag_exhaust apply clarsimp subgoal by (fastforce simp: pte_get_tag_alt pte_tag_defs cpte_relation_def
                           fst_return typ_heap_simps framesize_from_H_simps
                           pte_pte_large_lift_def pte_pte_small_lift_def
                           pte_pte_invalid_def Let_def
                    intro: resolve_ret_rel_Some
                    split: pte.splits) apply (rule guard_is_UNIVI) apply (clarsimp simp: typ_heap_simps) apply (auto simp: ptBits_def pageBits_def pteBits_def
               dest!: page_table_at_rf_sr
               elim: clift_array_assertion_imp)[1] apply (rule_tac P'="{s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddr)) = Some v
                                \<and> cpde_relation rv v
                                \<and> ret__unsigned = pde_get_tag v}"
              in ccorres_from_vcg_might_throw[where P=\<top>]) apply (rule allI, rule conseqPre, vcg) apply clarsimp subgoal by (fastforce simp: isPageTablePDE_def pde_get_tag_alt pde_tag_defs cpde_relation_def
                         fst_return typ_heap_simps framesize_from_H_simps
                         pde_pde_section_lift_def
                  intro: resolve_ret_rel_Some
                  split: pde.splits) apply clarsimp apply (frule(1) page_directory_at_rf_sr) apply (clarsimp simp: isPageTablePDE_def pde_get_tag_alt pde_tag_defs cpde_relation_def
                        typ_heap_simps pde_pde_coarse_lift_def
                        clift_array_assertion_imp pageBits_def Let_def
                 split: pde.splits) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (page_directory_at' pd) (UNIV \<inter> \<lbrace>\<acute>pd = pde_Ptr pd\<rbrace> \<inter> \<lbrace>\<acute>vaddr = vaddr\<rbrace>) hs (resolveVAddr pd vaddr) (Call resolveVAddr_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>vaddra pda. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?Q1689 vaddra pda) (?Q'1689 vaddra pda) (SKIP # hs) (getObject (lookup_pd_slot pd vaddr) >>= ARM_H.case_pde (return None) (\<lambda>table v61 v62. do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od) (\<lambda>frame v50 v51 v52 v53 v54 v55. return (Some (Wellformed_C.ARMSection, frame))) (\<lambda>frame v56 v57 v58 v59 v60. return (Some (Wellformed_C.ARMSuperSection, frame)))) (\<acute>pde___ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pda,vaddra);;
(\<acute>ret___struct_resolve_ret_C :== kernel_all_global_addresses.default_resolve_ret_t;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_resolve_ret_C;;
(\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pde___ptr_to_struct_pde_C);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) \<acute>ret___struct_resolve_ret_C;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(\<acute>pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(\<acute>pt,vaddra);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) \<acute>ret___struct_resolve_ret_C;;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) \<acute>ret___struct_resolve_ret_C;;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))))))
 2. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1689 vaddra pda s \<and> s' \<in> ?Q'1689 vaddra pda proof (prove)
goal (2 subgoals):
 1. ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?Q1689 vaddr (pde_Ptr pd)) (?Q'1689 vaddr (pde_Ptr pd)) (SKIP # hs) (getObject (lookup_pd_slot pd vaddr) >>= ARM_H.case_pde (return None) (\<lambda>table v61 v62. do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od) (\<lambda>frame v50 v51 v52 v53 v54 v55. return (Some (Wellformed_C.ARMSection, frame))) (\<lambda>frame v56 v57 v58 v59 v60. return (Some (Wellformed_C.ARMSuperSection, frame)))) (\<acute>pde___ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
(\<acute>ret___struct_resolve_ret_C :== kernel_all_global_addresses.default_resolve_ret_t;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_resolve_ret_C;;
(\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pde___ptr_to_struct_pde_C);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) \<acute>ret___struct_resolve_ret_C;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(\<acute>pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) \<acute>ret___struct_resolve_ret_C;;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) \<acute>ret___struct_resolve_ret_C;;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))))))
 2. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1689 vaddra pda s \<and> s' \<in> ?Q'1689 vaddra pda proof (prove)
goal (2 subgoals):
 1. \<And>rv. ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (\<lambda>a. ?P1702 vaddr (pde_Ptr pd) a rv) (?P'1703 vaddr (pde_Ptr pd) rv) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
a <- getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr);
case a of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (\<acute>pde___ptr_to_struct_pde_C :== CALL lookupPDSlot_'proc(pde_Ptr pd,vaddr);;
(\<acute>ret___struct_resolve_ret_C :== kernel_all_global_addresses.default_resolve_ret_t;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) \<acute>ret___struct_resolve_ret_C;;
(\<acute>ret__unsigned :== CALL pde_ptr_get_pdeType_'proc(\<acute>pde___ptr_to_struct_pde_C);;
(IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(\<acute>pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) \<acute>ret___struct_resolve_ret_C;;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(\<acute>pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(\<acute>pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) \<acute>ret___struct_resolve_ret_C;;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) \<acute>ret___struct_resolve_ret_C;;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))))))
 2. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> ?P1702 vaddra pda s pde) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> ?P'1703 vaddra pda pde} proof (prove)
goal (2 subgoals):
 1. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr) \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?P1708 vaddr (pde_Ptr pd) rv) (?G'2857 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned \<inter> {s. ret__unsigned = pde_get_tag (the (cslift s pde___ptr_to_struct_pde_C))}) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 2. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> ?P1708 vaddra pda pde s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> ?G'2857 vaddra pda pde v va}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (2 subgoals):
 1. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr) \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?P1708 vaddr (pde_Ptr pd) rv) (?G'3098 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 2. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> ?P1708 vaddra pda pde s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> ?G'3098 vaddra pda pde v va}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (2 subgoals):
 1. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?P1708 vaddr (pde_Ptr pd) rv) (?G'3101 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 2. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> ?P1708 vaddra pda pde s) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> ?G'3101 vaddra pda pde v va \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (3 subgoals):
 1. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?G3107 vaddr (pde_Ptr pd) rv) (?G'3109 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 2. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 3. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> ?G3107 vaddra pda pde s) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> ?G'3109 vaddra pda pde v va} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (3 subgoals):
 1. \<And>rv. isPageTablePDE rv \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?G3107 vaddr (pde_Ptr pd) rv) (?G'3109 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 2. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 3. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> ?G3107 vaddra pda pde s) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> ?G'3109 vaddra pda pde v va} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (6 subgoals):
 1. \<And>rv. \<lbrakk>isPageTablePDE rv; rv = ARM_H.InvalidPDE\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?R3164 vaddr (pde_Ptr pd) rv) (?R''3168 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1) (SKIP # hs) (return None) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 2. \<And>rv x21 x22 x23. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?R3175 vaddr (pde_Ptr pd) rv x21 x22 x23) (?R''3167 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 x21 x22 x23) (SKIP # hs) (do y <- stateAssert (page_table_at' (ptrFromPAddr x21)) [];
a <- getObject (lookup_pt_slot_no_fail (ptrFromPAddr x21) vaddr);
case a of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))
od) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 3. \<And>rv x31 x32 x33 x34 x35 x36 x37. \<lbrakk>isPageTablePDE rv; rv = ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?R3173 vaddr (pde_Ptr pd) rv x31 x32 x33 x34 x35 x36 x37) (?R''3166 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 x31 x32 x33 x34 x35 x36 x37) (SKIP # hs) (return (Some (Wellformed_C.ARMSection, x31))) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 4. \<And>rv x41 x42 x43 x44 x45 x46. \<lbrakk>isPageTablePDE rv; rv = ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (\<lambda>a. ?R3161 vaddr (pde_Ptr pd) rv a x41 x42 x43 x44 x45 x46) (?R''3165 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 x41 x42 x43 x44 x45 x46) (SKIP # hs) (return (Some (Wellformed_C.ARMSuperSection, x41))) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 5. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 6. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> ?R3164 vaddra pda pde s) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> ?R3175 vaddra pda pde x xa xb s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> ?R3173 vaddra pda pde x xa xb xc xd xe xf s) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> ?R3161 vaddra pda pde s x xa xb xc xd xe)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> ?R''3168 vaddra pda pde v va} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> ?R''3167 vaddra pda pde v va x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> ?R''3166 vaddra pda pde v va x xa xb xc xd xe xf}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> ?R''3165 vaddra pda pde v va x xa xb xc xd xe}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (6 subgoals):
 1. \<And>rv. \<lbrakk>isPageTablePDE rv; rv = ARM_H.InvalidPDE\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (\<lambda>s. True) UNIV (SKIP # hs) (return None) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 2. \<And>rv x21 x22 x23. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?R3175 vaddr (pde_Ptr pd) rv x21 x22 x23) (?R''3167 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 x21 x22 x23) (SKIP # hs) (do y <- stateAssert (page_table_at' (ptrFromPAddr x21)) [];
a <- getObject (lookup_pt_slot_no_fail (ptrFromPAddr x21) vaddr);
case a of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))
od) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 3. \<And>rv x31 x32 x33 x34 x35 x36 x37. \<lbrakk>isPageTablePDE rv; rv = ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?R3173 vaddr (pde_Ptr pd) rv x31 x32 x33 x34 x35 x36 x37) (?R''3166 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 x31 x32 x33 x34 x35 x36 x37) (SKIP # hs) (return (Some (Wellformed_C.ARMSection, x31))) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 4. \<And>rv x41 x42 x43 x44 x45 x46. \<lbrakk>isPageTablePDE rv; rv = ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (\<lambda>a. ?R3161 vaddr (pde_Ptr pd) rv a x41 x42 x43 x44 x45 x46) (?R''3165 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 x41 x42 x43 x44 x45 x46) (SKIP # hs) (return (Some (Wellformed_C.ARMSuperSection, x41))) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 5. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 6. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> ?R3175 vaddra pda pde x xa xb s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> ?R3173 vaddra pda pde x xa xb xc xd xe xf s) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> ?R3161 vaddra pda pde s x xa xb xc xd xe)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> ?R''3167 vaddra pda pde v va x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> ?R''3166 vaddra pda pde v va x xa xb xc xd xe xf}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> ?R''3165 vaddra pda pde v va x xa xb xc xd xe}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (5 subgoals):
 1. \<And>rv x21 x22 x23. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?R3175 vaddr (pde_Ptr pd) rv x21 x22 x23) (?R''3167 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 x21 x22 x23) (SKIP # hs) (do y <- stateAssert (page_table_at' (ptrFromPAddr x21)) [];
a <- getObject (lookup_pt_slot_no_fail (ptrFromPAddr x21) vaddr);
case a of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))
od) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 2. \<And>rv x31 x32 x33 x34 x35 x36 x37. \<lbrakk>isPageTablePDE rv; rv = ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?R3173 vaddr (pde_Ptr pd) rv x31 x32 x33 x34 x35 x36 x37) (?R''3166 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 x31 x32 x33 x34 x35 x36 x37) (SKIP # hs) (return (Some (Wellformed_C.ARMSection, x31))) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 3. \<And>rv x41 x42 x43 x44 x45 x46. \<lbrakk>isPageTablePDE rv; rv = ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (\<lambda>a. ?R3161 vaddr (pde_Ptr pd) rv a x41 x42 x43 x44 x45 x46) (?R''3165 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 x41 x42 x43 x44 x45 x46) (SKIP # hs) (return (Some (Wellformed_C.ARMSuperSection, x41))) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 4. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 5. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> ?R3175 vaddra pda pde x xa xb s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> ?R3173 vaddra pda pde x xa xb xc xd xe xf s) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> ?R3161 vaddra pda pde s x xa xb xc xd xe)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> ?R''3167 vaddra pda pde v va x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> ?R''3166 vaddra pda pde v va x xa xb xc xd xe xf}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> ?R''3165 vaddra pda pde v va x xa xb xc xd xe}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (5 subgoals):
 1. \<And>rv x31 x32 x33 x34 x35 x36 x37. \<lbrakk>isPageTablePDE rv; rv = ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?R3173 vaddr (pde_Ptr pd) rv x31 x32 x33 x34 x35 x36 x37) (?R''3166 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 x31 x32 x33 x34 x35 x36 x37) (SKIP # hs) (return (Some (Wellformed_C.ARMSection, x31))) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 2. \<And>rv x21 x22 x23. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?R3175 vaddr (pde_Ptr pd) rv x21 x22 x23) (?R''3167 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 x21 x22 x23) (SKIP # hs) (do y <- stateAssert (page_table_at' (ptrFromPAddr x21)) [];
a <- getObject (lookup_pt_slot_no_fail (ptrFromPAddr x21) vaddr);
case a of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))
od) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 3. \<And>rv x41 x42 x43 x44 x45 x46. \<lbrakk>isPageTablePDE rv; rv = ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (\<lambda>a. ?R3161 vaddr (pde_Ptr pd) rv a x41 x42 x43 x44 x45 x46) (?R''3165 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 x41 x42 x43 x44 x45 x46) (SKIP # hs) (return (Some (Wellformed_C.ARMSuperSection, x41))) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 4. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 5. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> ?R3175 vaddra pda pde x xa xb s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> ?R3173 vaddra pda pde x xa xb xc xd xe xf s) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> ?R3161 vaddra pda pde s x xa xb xc xd xe)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> ?R''3167 vaddra pda pde v va x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> ?R''3166 vaddra pda pde v va x xa xb xc xd xe xf}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> ?R''3165 vaddra pda pde v va x xa xb xc xd xe}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (5 subgoals):
 1. \<And>rv x31 x32 x33 x34 x35 x36 x37. \<lbrakk>isPageTablePDE rv; rv = ARM_H.SectionPDE x31 x32 x33 x34 x35 x36 x37\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (\<lambda>_. True) UNIV (SKIP # hs) (return (Some (Wellformed_C.ARMSection, x31))) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 2. \<And>rv x21 x22 x23. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?R3175 vaddr (pde_Ptr pd) rv x21 x22 x23) (?R''3167 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 x21 x22 x23) (SKIP # hs) (do y <- stateAssert (page_table_at' (ptrFromPAddr x21)) [];
a <- getObject (lookup_pt_slot_no_fail (ptrFromPAddr x21) vaddr);
case a of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))
od) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 3. \<And>rv x41 x42 x43 x44 x45 x46. \<lbrakk>isPageTablePDE rv; rv = ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (\<lambda>a. ?R3161 vaddr (pde_Ptr pd) rv a x41 x42 x43 x44 x45 x46) (?R''3165 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 x41 x42 x43 x44 x45 x46) (SKIP # hs) (return (Some (Wellformed_C.ARMSuperSection, x41))) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 4. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 5. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> ?R3175 vaddra pda pde x xa xb s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> ?R3161 vaddra pda pde s x xa xb xc xd xe)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> ?R''3167 vaddra pda pde v va x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> ?R''3165 vaddra pda pde v va x xa xb xc xd xe}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (4 subgoals):
 1. \<And>rv x21 x22 x23. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?R3175 vaddr (pde_Ptr pd) rv x21 x22 x23) (?R''3167 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 x21 x22 x23) (SKIP # hs) (do y <- stateAssert (page_table_at' (ptrFromPAddr x21)) [];
a <- getObject (lookup_pt_slot_no_fail (ptrFromPAddr x21) vaddr);
case a of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))
od) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 2. \<And>rv x41 x42 x43 x44 x45 x46. \<lbrakk>isPageTablePDE rv; rv = ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (\<lambda>a. ?R3161 vaddr (pde_Ptr pd) rv a x41 x42 x43 x44 x45 x46) (?R''3165 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 x41 x42 x43 x44 x45 x46) (SKIP # hs) (return (Some (Wellformed_C.ARMSuperSection, x41))) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 3. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 4. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> ?R3175 vaddra pda pde x xa xb s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> ?R3161 vaddra pda pde s x xa xb xc xd xe)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> ?R''3167 vaddra pda pde v va x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> ?R''3165 vaddra pda pde v va x xa xb xc xd xe}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (4 subgoals):
 1. \<And>rv x41 x42 x43 x44 x45 x46. \<lbrakk>isPageTablePDE rv; rv = ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (\<lambda>a. ?R3161 vaddr (pde_Ptr pd) rv a x41 x42 x43 x44 x45 x46) (?R''3165 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 x41 x42 x43 x44 x45 x46) (SKIP # hs) (return (Some (Wellformed_C.ARMSuperSection, x41))) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 2. \<And>rv x21 x22 x23. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?R3175 vaddr (pde_Ptr pd) rv x21 x22 x23) (?R''3167 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 x21 x22 x23) (SKIP # hs) (do y <- stateAssert (page_table_at' (ptrFromPAddr x21)) [];
a <- getObject (lookup_pt_slot_no_fail (ptrFromPAddr x21) vaddr);
case a of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))
od) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 3. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 4. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> ?R3175 vaddra pda pde x xa xb s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> ?R3161 vaddra pda pde s x xa xb xc xd xe)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> ?R''3167 vaddra pda pde v va x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> ?R''3165 vaddra pda pde v va x xa xb xc xd xe}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (4 subgoals):
 1. \<And>rv x41 x42 x43 x44 x45 x46. \<lbrakk>isPageTablePDE rv; rv = ARM_H.SuperSectionPDE x41 x42 x43 x44 x45 x46\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (\<lambda>_. True) UNIV (SKIP # hs) (return (Some (Wellformed_C.ARMSuperSection, x41))) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 2. \<And>rv x21 x22 x23. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?R3175 vaddr (pde_Ptr pd) rv x21 x22 x23) (?R''3167 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 x21 x22 x23) (SKIP # hs) (do y <- stateAssert (page_table_at' (ptrFromPAddr x21)) [];
a <- getObject (lookup_pt_slot_no_fail (ptrFromPAddr x21) vaddr);
case a of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))
od) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 3. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 4. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> ?R3175 vaddra pda pde x xa xb s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> ?R''3167 vaddra pda pde v va x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (3 subgoals):
 1. \<And>rv x21 x22 x23. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?R3175 vaddr (pde_Ptr pd) rv x21 x22 x23) (?R''3167 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 x21 x22 x23) (SKIP # hs) (do y <- stateAssert (page_table_at' (ptrFromPAddr x21)) [];
a <- getObject (lookup_pt_slot_no_fail (ptrFromPAddr x21) vaddr);
case a of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))
od) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 2. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 3. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> ?R3175 vaddra pda pde x xa xb s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> ?R''3167 vaddra pda pde v va x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (3 subgoals):
 1. \<And>rv word1 bool word2. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?R3175 vaddr (pde_Ptr pd) rv word1 bool word2) (?R''3167 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 word1 bool word2) (SKIP # hs) (do y <- stateAssert (page_table_at' (ptrFromPAddr word1)) [];
a <- getObject (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr);
case a of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))
od) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 2. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 3. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> ?R3175 vaddra pda pde x xa xb s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> ?R''3167 vaddra pda pde v va x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (3 subgoals):
 1. \<And>rv word1 bool word2. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?R3175 vaddr (pde_Ptr pd) rv word1 bool word2) (?R''3167 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 word1 bool word2) (SKIP # hs) (do y <- stateAssert (page_table_at' (ptrFromPAddr word1)) [];
a <- getObject (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr);
case a of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))
od) (\<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde_Ptr (lookup_pd_slot pd vaddr));;
(\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
(\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
(\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr);;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
(IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_')))))))
 2. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 3. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> ?R3175 vaddra pda pde x xa xb s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> ?R''3167 vaddra pda pde v va x xa xb}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (3 subgoals):
 1. \<And>rv word1 bool word2 ret__unsigned. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?R3175 vaddr (pde_Ptr pd) rv word1 bool word2) (?G'3199 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 word1 bool word2 ret__unsigned \<inter> {s. ret__unsigned = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s (pde_Ptr (lookup_pd_slot pd vaddr)))))}) (SKIP # hs) (do y <- stateAssert (page_table_at' (ptrFromPAddr word1)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od) (\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(ret__unsigned);;
(\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
(\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
(IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))))))
 2. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 3. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> ?R3175 vaddra pda pde x xa xb s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> ?G'3199 vaddra pda pde v va x xa xb vb}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s) \<and> pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (3 subgoals):
 1. \<And>rv word1 bool word2 ret__unsigned. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?R3175 vaddr (pde_Ptr pd) rv word1 bool word2) (?G'3497 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 word1 bool word2 ret__unsigned) (SKIP # hs) (do y <- stateAssert (page_table_at' (ptrFromPAddr word1)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od) (\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(ret__unsigned);;
(\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
(\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
(IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))))))
 2. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 3. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> ?R3175 vaddra pda pde x xa xb s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. s \<in> {s. vb = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s v)))} \<longrightarrow> s \<in> ?G'3497 vaddra pda pde v va x xa xb vb}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s) \<and> pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (3 subgoals):
 1. \<And>rv word1 bool word2 ret__unsigned. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?R3175 vaddr (pde_Ptr pd) rv word1 bool word2) (?G'3500 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 word1 bool word2 ret__unsigned) (SKIP # hs) (do y <- stateAssert (page_table_at' (ptrFromPAddr word1)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od) (\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(ret__unsigned);;
(\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
(\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
(IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))))))
 2. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 3. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> ?R3175 vaddra pda pde x xa xb s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. s \<in> {s. vb = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s v)))} \<longrightarrow> s \<in> ?G'3500 vaddra pda pde v va x xa xb vb \<inter> \<lbrace>vb = x\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s) \<and> pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (3 subgoals):
 1. \<And>rv word1 bool word2 ret__unsigned. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?P3503 vaddr (pde_Ptr pd) rv word1 bool word2) (?G'3500 vaddr (pde_Ptr pd) rv (pde_Ptr (lookup_pd_slot pd vaddr)) 1 word1 bool word2 ret__unsigned) (SKIP # hs) (do a <- getObject (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr);
case a of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))
od) (\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(ret__unsigned);;
(\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
(\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
(IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))))))
 2. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 3. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> page_table_at' (ptrFromPAddr x) s \<longrightarrow> ?P3503 vaddra pda pde x xa xb s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> {s. \<forall>vb v'. vb = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. s \<in> {s. vb = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s v)))} \<longrightarrow> s \<in> ?G'3500 vaddra pda pde v va x xa xb vb \<inter> \<lbrace>vb = x\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s) \<and> pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (6 subgoals):
 1. \<And>rv word1 bool word2 ret__unsigned s. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. True \<and> (s, s') \<in> rf_sr}) \<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(ret__unsigned) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__ptr_to_void = PTR(unit) (ptrFromPAddr word1)\<rbrace>)
 2. \<And>rv word1 bool word2 ret__unsigned rv' t t'. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__ptr_to_void_' rv' t t' (\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
(\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
(IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))))) (?y'3506 rv word1 bool word2 ret__unsigned rv')
 3. \<And>rv word1 bool word2 ret__unsigned. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?P3511 vaddr (pde_Ptr pd) rv word1 bool word2) (?Q3506 rv word1 bool word2 ret__unsigned) (SKIP # hs) (do a <- getObject (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr);
case a of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))
od) (?y'3506 rv word1 bool word2 ret__unsigned (PTR(unit) (ptrFromPAddr word1)))
 4. \<And>rv word1 bool word2 ret__unsigned. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = PTR(unit) (ptrFromPAddr word1)) ret__ptr_to_void_' (\<lambda>rva rv'. ?Q3506 rv word1 bool word2 ret__unsigned)
 5. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 6. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> page_table_at' (ptrFromPAddr x) s \<longrightarrow> (?P3511 vaddra pda pde x xa xb and (\<lambda>_. True)) s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> {s. \<forall>va v'. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s v)))} \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>va = x\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s) \<and> pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (5 subgoals):
 1. \<And>rv word1 bool word2 ret__unsigned rv' t t'. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ret__ptr_to_void_' rv' t t' (\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
(\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
(IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))))) (?y'3506 rv word1 bool word2 ret__unsigned rv')
 2. \<And>rv word1 bool word2 ret__unsigned. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?P3511 vaddr (pde_Ptr pd) rv word1 bool word2) (?Q3506 rv word1 bool word2 ret__unsigned) (SKIP # hs) (do a <- getObject (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr);
case a of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))
od) (?y'3506 rv word1 bool word2 ret__unsigned (PTR(unit) (ptrFromPAddr word1)))
 3. \<And>rv word1 bool word2 ret__unsigned. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = PTR(unit) (ptrFromPAddr word1)) ret__ptr_to_void_' (\<lambda>rva rv'. ?Q3506 rv word1 bool word2 ret__unsigned)
 4. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 5. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> page_table_at' (ptrFromPAddr x) s \<longrightarrow> (?P3511 vaddra pda pde x xa xb and (\<lambda>_. True)) s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> {s. \<forall>va v'. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s v)))} \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>va = x\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s) \<and> pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (4 subgoals):
 1. \<And>rv word1 bool word2 ret__unsigned. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?P3511 vaddr (pde_Ptr pd) rv word1 bool word2) (?Q3506 rv word1 bool word2 ret__unsigned) (SKIP # hs) (do a <- getObject (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr);
case a of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))
od) (\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1));;
(\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
(IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_')))))
 2. \<And>rv word1 bool word2 ret__unsigned. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = PTR(unit) (ptrFromPAddr word1)) ret__ptr_to_void_' (\<lambda>rva rv'. ?Q3506 rv word1 bool word2 ret__unsigned)
 3. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 4. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> page_table_at' (ptrFromPAddr x) s \<longrightarrow> (?P3511 vaddra pda pde x xa xb and (\<lambda>_. True)) s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> {s. \<forall>va v'. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s v)))} \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>va = x\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s) \<and> pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (4 subgoals):
 1. \<And>rv word1 bool word2 ret__unsigned rva. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (\<lambda>a. ?P3814 vaddr (pde_Ptr pd) rv word1 bool word2 a rva) (?P'3813 rv word1 bool word2 ret__unsigned rva) (SKIP # hs) (case rva of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))) (\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1));;
(\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
(IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_')))))
 2. \<And>rv word1 bool word2 ret__unsigned. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = PTR(unit) (ptrFromPAddr word1)) ret__ptr_to_void_' (\<lambda>rva rv'. {s. \<forall>pte pte'. cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr)) = Some pte' \<and> cpte_relation pte pte' \<longrightarrow> s \<in> ?P'3813 rv word1 bool word2 ret__unsigned pte})
 3. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 4. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> page_table_at' (ptrFromPAddr x) s \<longrightarrow> ((\<lambda>a. \<forall>pte. ko_at' pte (lookup_pt_slot_no_fail (ptrFromPAddr x) vaddra) a \<longrightarrow> ?P3814 vaddra pda pde x xa xb a pte) and (\<lambda>_. True)) s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> {s. \<forall>va v'. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s v)))} \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>va = x\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s) \<and> pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (4 subgoals):
 1. \<And>rv word1 bool word2 ret__unsigned rva. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?P'3819 vaddr (pde_Ptr pd) rv word1 bool word2 rva) (?Q3817 rv word1 bool word2 ret__unsigned rva) (SKIP # hs) (case rva of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))) (\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1));;
(\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
(IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_')))))
 2. \<And>rv word1 bool word2 ret__unsigned. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = PTR(unit) (ptrFromPAddr word1)) ret__ptr_to_void_' (\<lambda>rva rv'. {s. \<forall>pte pte'. cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr)) = Some pte' \<and> cpte_relation pte pte' \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> page_table_at' (ptrFromPAddr word1) s \<longrightarrow> s' \<in> ?Q3817 rv word1 bool word2 ret__unsigned pte}})
 3. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 4. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> page_table_at' (ptrFromPAddr x) s \<longrightarrow> ((\<lambda>a. \<forall>pte. ko_at' pte (lookup_pt_slot_no_fail (ptrFromPAddr x) vaddra) a \<longrightarrow> (page_table_at' (ptrFromPAddr x) and ?P'3819 vaddra pda pde x xa xb pte) a) and (\<lambda>_. True)) s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> {s. \<forall>va v'. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s v)))} \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>va = x\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s) \<and> pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (4 subgoals):
 1. \<And>rv word1 bool word2 ret__unsigned rva. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> {s. \<exists>v. cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr)) = Some v \<and> cpte_relation rva v \<and> array_assertion (pte_Ptr (ptrFromPAddr word1)) (2 ^ (ptBits - 2)) (hrs_htd (t_hrs_' (globals s)))} \<and> (\<sigma>, s) \<in> rf_sr} \<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1));;
(\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
(\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
(IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_')))) {s. \<exists>(rv, \<sigma>')\<in>fst ((case rva of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> resolve_ret_rel rv (ret__struct_resolve_ret_C_' s)},{s. \<exists>(rv, \<sigma>')\<in>fst ((case rva of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> resolve_ret_rel rv (ret__struct_resolve_ret_C_' s)}
 2. \<And>rv word1 bool word2 ret__unsigned. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = PTR(unit) (ptrFromPAddr word1)) ret__ptr_to_void_' (\<lambda>rv rv'. {s. \<forall>pte pte'. cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr)) = Some pte' \<and> cpte_relation pte pte' \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> page_table_at' (ptrFromPAddr word1) s \<longrightarrow> s' \<in> {s. \<exists>v. cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr)) = Some v \<and> cpte_relation pte v \<and> array_assertion (pte_Ptr (ptrFromPAddr word1)) (2 ^ (ptBits - 2)) (hrs_htd (t_hrs_' (globals s)))}}})
 3. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 4. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> page_table_at' (ptrFromPAddr x) s \<longrightarrow> ((\<lambda>a. \<forall>pte. ko_at' pte (lookup_pt_slot_no_fail (ptrFromPAddr x) vaddra) a \<longrightarrow> (page_table_at' (ptrFromPAddr x) and (\<lambda>a. True)) a) and (\<lambda>_. True)) s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> {s. \<forall>va v'. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s v)))} \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>va = x\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s) \<and> pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (4 subgoals):
 1. \<And>rv word1 bool word2 ret__unsigned rva \<sigma>. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> {s. \<exists>v. cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr)) = Some v \<and> cpte_relation rva v \<and> array_assertion (pte_Ptr (ptrFromPAddr word1)) (2 ^ (ptBits - 2)) (hrs_htd (t_hrs_' (globals s)))} \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. array_assertion (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1))) (2 ^ (ptBits - 2)) (hrs_htd (t_hrs_' (globals s))) \<and> (\<forall>t. ret__ptr_to_struct_pte_C_' t = pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr) \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr) \<and> (\<forall>t. ret__unsigned_' t = pte_get_tag (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))) \<longrightarrow> (pte_get_tag (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))) = SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr) \<and> (\<forall>t. ret__unsigned_' t = pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr))))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case rva of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))) \<sigma>). (\<sigma>', s\<lparr>pt_' := PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)), pte___ptr_to_struct_pte_C_' := pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr), ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_small, ret__unsigned_' := pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr))))), ret___struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))))) kernel_all_global_addresses.default_resolve_ret_t)), ret__struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))))) kernel_all_global_addresses.default_resolve_ret_t)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> resolve_ret_rel rv (frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))))) kernel_all_global_addresses.default_resolve_ret_t)))))) \<and> (pte_get_tag (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))) \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr) \<and> pte_get_tag (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))) = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> (\<forall>t. ret__unsigned_' t = reserved_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr))))) \<longrightarrow> (reserved_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr))))) = SCAST(32 signed \<rightarrow> 32) 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) pte_pte_large \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<and> (SCAST(32 signed \<rightarrow> 32) pte_pte_large \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr) \<and> pte_get_tag (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))) = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> (\<forall>t. ret__unsigned_' t = pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr))))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case rva of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))) \<sigma>). (\<sigma>', s\<lparr>pt_' := PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)), pte___ptr_to_struct_pte_C_' := pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr), ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_large, ret__unsigned_' := pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr))))), ret___struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))))) kernel_all_global_addresses.default_resolve_ret_t)), ret__struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))))) kernel_all_global_addresses.default_resolve_ret_t)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> resolve_ret_rel rv (frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))))) kernel_all_global_addresses.default_resolve_ret_t))))))) \<and> (reserved_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr))))) \<noteq> SCAST(32 signed \<rightarrow> 32) 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) pte_pte_invalid \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<and> (SCAST(32 signed \<rightarrow> 32) pte_pte_invalid \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) pte_pte_invalid = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr) \<and> pte_get_tag (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))) = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> (\<forall>t. ret__unsigned_' t = pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr))))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case rva of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))) \<sigma>). (\<sigma>', s\<lparr>pt_' := PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)), pte___ptr_to_struct_pte_C_' := pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr), ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_large, ret__unsigned_' := pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr))))), ret___struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))))) kernel_all_global_addresses.default_resolve_ret_t)), ret__struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))))) kernel_all_global_addresses.default_resolve_ret_t)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> resolve_ret_rel rv (frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))))) kernel_all_global_addresses.default_resolve_ret_t)))))) \<and> (SCAST(32 signed \<rightarrow> 32) pte_pte_invalid \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case rva of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))) \<sigma>). (\<sigma>', s\<lparr>pt_' := PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)), pte___ptr_to_struct_pte_C_' := pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr), ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_invalid, ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t, ret__struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> resolve_ret_rel rv (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t)))))))))}
 2. \<And>rv word1 bool word2 ret__unsigned. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = PTR(unit) (ptrFromPAddr word1)) ret__ptr_to_void_' (\<lambda>rv rv'. {s. \<forall>pte pte'. cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr)) = Some pte' \<and> cpte_relation pte pte' \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> page_table_at' (ptrFromPAddr word1) s \<longrightarrow> s' \<in> {s. \<exists>v. cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr)) = Some v \<and> cpte_relation pte v \<and> array_assertion (pte_Ptr (ptrFromPAddr word1)) (2 ^ (ptBits - 2)) (hrs_htd (t_hrs_' (globals s)))}}})
 3. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 4. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> page_table_at' (ptrFromPAddr x) s \<longrightarrow> ((\<lambda>a. \<forall>pte. ko_at' pte (lookup_pt_slot_no_fail (ptrFromPAddr x) vaddra) a \<longrightarrow> (page_table_at' (ptrFromPAddr x) and (\<lambda>a. True)) a) and (\<lambda>_. True)) s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> {s. \<forall>va v'. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s v)))} \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>va = x\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s) \<and> pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
using this:
pte_get_tag ?pte = 0 \<or> pte_get_tag ?pte = 1

goal (4 subgoals):
 1. \<And>rv word1 bool word2 ret__unsigned rva \<sigma>. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> {s. \<exists>v. cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr)) = Some v \<and> cpte_relation rva v \<and> array_assertion (pte_Ptr (ptrFromPAddr word1)) (2 ^ (ptBits - 2)) (hrs_htd (t_hrs_' (globals s)))} \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. array_assertion (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1))) (2 ^ (ptBits - 2)) (hrs_htd (t_hrs_' (globals s))) \<and> (\<forall>t. ret__ptr_to_struct_pte_C_' t = pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr) \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr) \<and> (\<forall>t. ret__unsigned_' t = pte_get_tag (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))) \<longrightarrow> (pte_get_tag (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))) = SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr) \<and> (\<forall>t. ret__unsigned_' t = pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr))))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case rva of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))) \<sigma>). (\<sigma>', s\<lparr>pt_' := PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)), pte___ptr_to_struct_pte_C_' := pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr), ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_small, ret__unsigned_' := pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr))))), ret___struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))))) kernel_all_global_addresses.default_resolve_ret_t)), ret__struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))))) kernel_all_global_addresses.default_resolve_ret_t)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> resolve_ret_rel rv (frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))))) kernel_all_global_addresses.default_resolve_ret_t)))))) \<and> (pte_get_tag (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))) \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr) \<and> pte_get_tag (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))) = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> (\<forall>t. ret__unsigned_' t = reserved_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr))))) \<longrightarrow> (reserved_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr))))) = SCAST(32 signed \<rightarrow> 32) 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) pte_pte_large \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<and> (SCAST(32 signed \<rightarrow> 32) pte_pte_large \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr) \<and> pte_get_tag (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))) = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> (\<forall>t. ret__unsigned_' t = pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr))))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case rva of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))) \<sigma>). (\<sigma>', s\<lparr>pt_' := PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)), pte___ptr_to_struct_pte_C_' := pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr), ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_large, ret__unsigned_' := pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr))))), ret___struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))))) kernel_all_global_addresses.default_resolve_ret_t)), ret__struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))))) kernel_all_global_addresses.default_resolve_ret_t)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> resolve_ret_rel rv (frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))))) kernel_all_global_addresses.default_resolve_ret_t))))))) \<and> (reserved_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr))))) \<noteq> SCAST(32 signed \<rightarrow> 32) 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) pte_pte_invalid \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<and> (SCAST(32 signed \<rightarrow> 32) pte_pte_invalid \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) pte_pte_invalid = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr) \<and> pte_get_tag (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))) = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> (\<forall>t. ret__unsigned_' t = pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr))))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case rva of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))) \<sigma>). (\<sigma>', s\<lparr>pt_' := PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)), pte___ptr_to_struct_pte_C_' := pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr), ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_large, ret__unsigned_' := pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr))))), ret___struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))))) kernel_all_global_addresses.default_resolve_ret_t)), ret__struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))))) kernel_all_global_addresses.default_resolve_ret_t)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> resolve_ret_rel rv (frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr)))))) kernel_all_global_addresses.default_resolve_ret_t)))))) \<and> (SCAST(32 signed \<rightarrow> 32) pte_pte_invalid \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case rva of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))) \<sigma>). (\<sigma>', s\<lparr>pt_' := PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)), pte___ptr_to_struct_pte_C_' := pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr word1)))) vaddr), ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_invalid, ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t, ret__struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> resolve_ret_rel rv (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t)))))))))}
 2. \<And>rv word1 bool word2 ret__unsigned. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = PTR(unit) (ptrFromPAddr word1)) ret__ptr_to_void_' (\<lambda>rv rv'. {s. \<forall>pte pte'. cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr)) = Some pte' \<and> cpte_relation pte pte' \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> page_table_at' (ptrFromPAddr word1) s \<longrightarrow> s' \<in> {s. \<exists>v. cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr)) = Some v \<and> cpte_relation pte v \<and> array_assertion (pte_Ptr (ptrFromPAddr word1)) (2 ^ (ptBits - 2)) (hrs_htd (t_hrs_' (globals s)))}}})
 3. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 4. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> page_table_at' (ptrFromPAddr x) s \<longrightarrow> ((\<lambda>a. \<forall>pte. ko_at' pte (lookup_pt_slot_no_fail (ptrFromPAddr x) vaddra) a \<longrightarrow> (page_table_at' (ptrFromPAddr x) and (\<lambda>a. True)) a) and (\<lambda>_. True)) s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> {s. \<forall>va v'. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s v)))} \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>va = x\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s) \<and> pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (4 subgoals):
 1. \<And>word1 bool word2 rva \<sigma> x v t. \<lbrakk>isPageTablePDE (ARM_H.PageTablePDE word1 bool word2); \<And>pte. pte_get_tag pte = 0 \<or> pte_get_tag pte = 1; (\<sigma>, x) \<in> rf_sr; cslift x (pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr)) = Some v; cpte_relation rva v; array_assertion (pte_Ptr (ptrFromPAddr word1)) (2 ^ (ptBits - 2)) (hrs_htd (t_hrs_' (globals x))); ret__ptr_to_struct_pte_C_' t = pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr)\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr) \<and> ((\<exists>t. ret__unsigned_' t = pte_get_tag v) \<longrightarrow> (pte_get_tag v = SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> x \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr) \<and> ((\<exists>t. ret__unsigned_' t = pte_pte_small_CL.address_CL (pte_pte_small_lift v)) \<longrightarrow> (\<exists>xa\<in>fst ((case rva of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> resolve_ret_rel rv (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (frameBase_C_update (\<lambda>_. pte_pte_small_CL.address_CL (pte_pte_small_lift v)) kernel_all_global_addresses.default_resolve_ret_t)))))) \<and> (pte_get_tag v \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> x \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr) \<and> pte_get_tag v = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> ((\<exists>t. ret__unsigned_' t = reserved_CL (pte_pte_large_lift v)) \<longrightarrow> (reserved_CL (pte_pte_large_lift v) = 1 \<longrightarrow> pte_pte_large \<noteq> pte_pte_small \<and> (pte_pte_large \<noteq> pte_pte_small \<longrightarrow> x \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr) \<and> pte_get_tag v = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> ((\<exists>t. ret__unsigned_' t = pte_pte_large_CL.address_CL (pte_pte_large_lift v)) \<longrightarrow> (\<exists>xa\<in>fst ((case rva of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> resolve_ret_rel rv (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift v)) kernel_all_global_addresses.default_resolve_ret_t))))))) \<and> (reserved_CL (pte_pte_large_lift v) \<noteq> 1 \<longrightarrow> pte_pte_invalid \<noteq> pte_pte_small \<and> (pte_pte_invalid \<noteq> pte_pte_small \<longrightarrow> (pte_pte_invalid = pte_pte_large \<longrightarrow> x \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr) \<and> pte_get_tag v = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> ((\<exists>t. ret__unsigned_' t = pte_pte_large_CL.address_CL (pte_pte_large_lift v)) \<longrightarrow> (\<exists>xa\<in>fst ((case rva of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> resolve_ret_rel rv (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift v)) kernel_all_global_addresses.default_resolve_ret_t)))))) \<and> (pte_pte_invalid \<noteq> pte_pte_large \<longrightarrow> (\<exists>xa\<in>fst ((case rva of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> resolve_ret_rel rv (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t))))))))
 2. \<And>rv word1 bool word2 ret__unsigned. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = PTR(unit) (ptrFromPAddr word1)) ret__ptr_to_void_' (\<lambda>rv rv'. {s. \<forall>pte pte'. cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr)) = Some pte' \<and> cpte_relation pte pte' \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> page_table_at' (ptrFromPAddr word1) s \<longrightarrow> s' \<in> {s. \<exists>v. cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr)) = Some v \<and> cpte_relation pte v \<and> array_assertion (pte_Ptr (ptrFromPAddr word1)) (2 ^ (ptBits - 2)) (hrs_htd (t_hrs_' (globals s)))}}})
 3. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 4. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> page_table_at' (ptrFromPAddr x) s \<longrightarrow> ((\<lambda>a. \<forall>pte. ko_at' pte (lookup_pt_slot_no_fail (ptrFromPAddr x) vaddra) a \<longrightarrow> (page_table_at' (ptrFromPAddr x) and (\<lambda>a. True)) a) and (\<lambda>_. True)) s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> {s. \<forall>va v'. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s v)))} \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>va = x\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s) \<and> pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>isPageTablePDE (ARM_H.PageTablePDE word1_ bool_ word2_); \<And>pte. pte_get_tag pte = 0 \<or> pte_get_tag pte = 1; (\<sigma>_, x_) \<in> rf_sr; cslift x_ (pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1_) vaddr)) = Some v_; cpte_relation rva_ v_; array_assertion (pte_Ptr (ptrFromPAddr word1_)) (2 ^ (ptBits - 2)) (hrs_htd (t_hrs_' (globals x_))); ret__ptr_to_struct_pte_C_' t_ = pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1_) vaddr)\<rbrakk> \<Longrightarrow> x_ \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1_) vaddr) \<and> ((\<exists>t. ret__unsigned_' t = pte_get_tag v_) \<longrightarrow> (pte_get_tag v_ = SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> x_ \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1_) vaddr) \<and> ((\<exists>t. ret__unsigned_' t = pte_pte_small_CL.address_CL (pte_pte_small_lift v_)) \<longrightarrow> (\<exists>xa\<in>fst ((case rva_ of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))) \<sigma>_). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x_) \<in> rf_sr \<and> resolve_ret_rel rv (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (frameBase_C_update (\<lambda>_. pte_pte_small_CL.address_CL (pte_pte_small_lift v_)) kernel_all_global_addresses.default_resolve_ret_t)))))) \<and> (pte_get_tag v_ \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> x_ \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1_) vaddr) \<and> pte_get_tag v_ = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> ((\<exists>t. ret__unsigned_' t = reserved_CL (pte_pte_large_lift v_)) \<longrightarrow> (reserved_CL (pte_pte_large_lift v_) = 1 \<longrightarrow> pte_pte_large \<noteq> pte_pte_small \<and> (pte_pte_large \<noteq> pte_pte_small \<longrightarrow> x_ \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1_) vaddr) \<and> pte_get_tag v_ = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> ((\<exists>t. ret__unsigned_' t = pte_pte_large_CL.address_CL (pte_pte_large_lift v_)) \<longrightarrow> (\<exists>xa\<in>fst ((case rva_ of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))) \<sigma>_). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x_) \<in> rf_sr \<and> resolve_ret_rel rv (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift v_)) kernel_all_global_addresses.default_resolve_ret_t))))))) \<and> (reserved_CL (pte_pte_large_lift v_) \<noteq> 1 \<longrightarrow> pte_pte_invalid \<noteq> pte_pte_small \<and> (pte_pte_invalid \<noteq> pte_pte_small \<longrightarrow> (pte_pte_invalid = pte_pte_large \<longrightarrow> x_ \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1_) vaddr) \<and> pte_get_tag v_ = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> ((\<exists>t. ret__unsigned_' t = pte_pte_large_CL.address_CL (pte_pte_large_lift v_)) \<longrightarrow> (\<exists>xa\<in>fst ((case rva_ of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))) \<sigma>_). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x_) \<in> rf_sr \<and> resolve_ret_rel rv (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift v_)) kernel_all_global_addresses.default_resolve_ret_t)))))) \<and> (pte_pte_invalid \<noteq> pte_pte_large \<longrightarrow> (\<exists>xa\<in>fst ((case rva_ of ARM_H.InvalidPTE \<Rightarrow> return None | ARM_H.LargePagePTE frame v42 v43 v44 v45 \<Rightarrow> return (Some (Wellformed_C.ARMLargePage, frame)) | ARM_H.SmallPagePTE frame v46 v47 v48 v49 \<Rightarrow> return (Some (Wellformed_C.ARMSmallPage, frame))) \<sigma>_). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x_) \<in> rf_sr \<and> resolve_ret_rel rv (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t)))))))) proof (prove)
goal (3 subgoals):
 1. \<And>rv word1 bool word2 ret__unsigned. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = PTR(unit) (ptrFromPAddr word1)) ret__ptr_to_void_' (\<lambda>rv rv'. {s. \<forall>pte pte'. cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr)) = Some pte' \<and> cpte_relation pte pte' \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> page_table_at' (ptrFromPAddr word1) s \<longrightarrow> s' \<in> {s. \<exists>v. cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr)) = Some v \<and> cpte_relation pte v \<and> array_assertion (pte_Ptr (ptrFromPAddr word1)) (2 ^ (ptBits - 2)) (hrs_htd (t_hrs_' (globals s)))}}})
 2. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 3. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> page_table_at' (ptrFromPAddr x) s \<longrightarrow> ((\<lambda>a. \<forall>pte. ko_at' pte (lookup_pt_slot_no_fail (ptrFromPAddr x) vaddra) a \<longrightarrow> (page_table_at' (ptrFromPAddr x) and (\<lambda>a. True)) a) and (\<lambda>_. True)) s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> {s. \<forall>va v'. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s v)))} \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>va = x\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s) \<and> pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (3 subgoals):
 1. \<And>rv word1 bool word2 ret__unsigned s rva. \<lbrakk>isPageTablePDE rv; rv = ARM_H.PageTablePDE word1 bool word2; ret__unsigned = word1; ret__ptr_to_void_' s = PTR(unit) (ptrFromPAddr word1)\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>pte pte'. cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr)) = Some pte' \<and> cpte_relation pte pte' \<longrightarrow> s \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> page_table_at' (ptrFromPAddr word1) s \<longrightarrow> s' \<in> {s. \<exists>v. cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr)) = Some v \<and> cpte_relation pte v \<and> array_assertion (pte_Ptr (ptrFromPAddr word1)) (2 ^ (ptBits - 2)) (hrs_htd (t_hrs_' (globals s)))}}}
 2. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 3. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> page_table_at' (ptrFromPAddr x) s \<longrightarrow> ((\<lambda>a. \<forall>pte. ko_at' pte (lookup_pt_slot_no_fail (ptrFromPAddr x) vaddra) a \<longrightarrow> (page_table_at' (ptrFromPAddr x) and (\<lambda>a. True)) a) and (\<lambda>_. True)) s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> {s. \<forall>va v'. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s v)))} \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>va = x\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s) \<and> pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (3 subgoals):
 1. \<And>word1 bool word2 s pte pte' sa. \<lbrakk>isPageTablePDE (ARM_H.PageTablePDE word1 bool word2); ret__ptr_to_void_' s = PTR(unit) (ptrFromPAddr word1); cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptrFromPAddr word1) vaddr)) = Some pte'; cpte_relation pte pte'; (sa, s) \<in> rf_sr; page_table_at' (ptrFromPAddr word1) sa\<rbrakk> \<Longrightarrow> array_assertion (pte_Ptr (ptrFromPAddr word1)) (2 ^ (ptBits - 2)) (hrs_htd (t_hrs_' (globals s)))
 2. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 3. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> page_table_at' (ptrFromPAddr x) s \<longrightarrow> ((\<lambda>a. \<forall>pte. ko_at' pte (lookup_pt_slot_no_fail (ptrFromPAddr x) vaddra) a \<longrightarrow> (page_table_at' (ptrFromPAddr x) and (\<lambda>a. True)) a) and (\<lambda>_. True)) s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> {s. \<forall>va v'. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s v)))} \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>va = x\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s) \<and> pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (2 subgoals):
 1. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> ccorres resolve_ret_rel ret__struct_resolve_ret_C_' (?H3106 vaddr (pde_Ptr pd) rv) (?H'3108 vaddr (pde_Ptr pd) rv pde___ptr_to_struct_pde_C ret__unsigned) (SKIP # hs) (case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'))
 2. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> page_table_at' (ptrFromPAddr x) s \<longrightarrow> ((\<lambda>a. \<forall>pte. ko_at' pte (lookup_pt_slot_no_fail (ptrFromPAddr x) vaddra) a \<longrightarrow> (page_table_at' (ptrFromPAddr x) and (\<lambda>a. True)) a) and (\<lambda>_. True)) s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> ?H3106 vaddra pda pde s)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> {s. \<forall>va v'. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s v)))} \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>va = x\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s) \<and> pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> ?H'3108 vaddra pda pde v va} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (2 subgoals):
 1. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddr)) = Some v \<and> cpde_relation rv v \<and> ret__unsigned = pde_get_tag v} \<and> (\<sigma>, s) \<in> rf_sr} IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section THEN
  \<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret__unsigned :== CALL pde_pde_section_ptr_get_size_'proc(pde___ptr_to_struct_pde_C);;
IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) \<acute>ret___struct_resolve_ret_C
ELSE
  \<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) \<acute>ret___struct_resolve_ret_C
FI;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse THEN
  \<acute>ret__unsigned :== CALL pde_pde_coarse_ptr_get_address_'proc(pde___ptr_to_struct_pde_C);;
\<acute>ret__ptr_to_void :== CALL ptrFromPAddr_'proc(\<acute>ret__unsigned);;
\<acute>pt :== PTR_COERCE(unit \<rightarrow> pte_C) \<acute>ret__ptr_to_void;;
\<acute>pte___ptr_to_struct_pte_C :== CALL lookupPTSlot_nofail_'proc(vaddr,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL pte_ptr_get_pteType_'proc(\<acute>pte___ptr_to_struct_pte_C);;
IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_small THEN
  \<acute>ret__unsigned :== CALL pte_pte_small_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
ELSE
  IF \<acute>ret__unsigned_long = SCAST(32 signed \<rightarrow> 32) pte_pte_large THEN
  \<acute>ret__unsigned :== CALL pte_pte_large_ptr_get_address_'proc(\<acute>pte___ptr_to_struct_pte_C);;
\<acute>ret___struct_resolve_ret_C :== frameBase_C_update (\<lambda>_. \<acute>ret__unsigned) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
\<acute>ret___struct_resolve_ret_C :== frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) \<acute>ret___struct_resolve_ret_C;;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_'
FI
FI
FI
FI;;
(\<acute>ret___struct_resolve_ret_C :== valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t);;
return_C ret__struct_resolve_ret_C_'_update ret___struct_resolve_ret_C_') {s. \<exists>(rv, \<sigma>')\<in>fst ((case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> resolve_ret_rel rv (ret__struct_resolve_ret_C_' s)},{s. \<exists>(rv, \<sigma>')\<in>fst ((case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> resolve_ret_rel rv (ret__struct_resolve_ret_C_' s)}
 2. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> page_table_at' (ptrFromPAddr x) s \<longrightarrow> ((\<lambda>a. \<forall>pte. ko_at' pte (lookup_pt_slot_no_fail (ptrFromPAddr x) vaddra) a \<longrightarrow> (page_table_at' (ptrFromPAddr x) and (\<lambda>a. True)) a) and (\<lambda>_. True)) s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> {s. \<forall>va v'. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s v)))} \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>va = x\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s) \<and> pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> va = pde_get_tag v}} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (2 subgoals):
 1. \<And>rv pde___ptr_to_struct_pde_C ret__unsigned \<sigma>. \<lbrakk>pde___ptr_to_struct_pde_C = pde_Ptr (lookup_pd_slot pd vaddr); (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE rv; \<not> isPageTablePDE rv\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddr)) = Some v \<and> cpde_relation rv v \<and> ret__unsigned = pde_get_tag v} \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> s \<Turnstile>\<^sub>c pde___ptr_to_struct_pde_C \<and> pde_get_tag (the (cslift s pde___ptr_to_struct_pde_C)) = SCAST(32 signed \<rightarrow> 32) pde_pde_section \<and> (\<forall>t. ret__unsigned_' t = pde_pde_section_CL.address_CL (pde_pde_section_lift (the (cslift s pde___ptr_to_struct_pde_C))) \<longrightarrow> s \<Turnstile>\<^sub>c pde___ptr_to_struct_pde_C \<and> pde_get_tag (the (cslift s pde___ptr_to_struct_pde_C)) = SCAST(32 signed \<rightarrow> 32) pde_pde_section \<and> (\<forall>t. ret__unsigned_' t = size_CL (pde_pde_section_lift (the (cslift s pde___ptr_to_struct_pde_C))) \<longrightarrow> (size_CL (pde_pde_section_lift (the (cslift s pde___ptr_to_struct_pde_C))) \<noteq> 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := size_CL (pde_pde_section_lift (the (cslift s pde___ptr_to_struct_pde_C))), ret___struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (frameBase_C_update (\<lambda>_. pde_pde_section_CL.address_CL (pde_pde_section_lift (the (cslift s pde___ptr_to_struct_pde_C)))) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t)), ret__struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (frameBase_C_update (\<lambda>_. pde_pde_section_CL.address_CL (pde_pde_section_lift (the (cslift s pde___ptr_to_struct_pde_C)))) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> resolve_ret_rel rv (frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (frameBase_C_update (\<lambda>_. pde_pde_section_CL.address_CL (pde_pde_section_lift (the (cslift s pde___ptr_to_struct_pde_C)))) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t))))) \<and> (size_CL (pde_pde_section_lift (the (cslift s pde___ptr_to_struct_pde_C))) = 0 \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := 0, ret___struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) (frameBase_C_update (\<lambda>_. pde_pde_section_CL.address_CL (pde_pde_section_lift (the (cslift s pde___ptr_to_struct_pde_C)))) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t)), ret__struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) (frameBase_C_update (\<lambda>_. pde_pde_section_CL.address_CL (pde_pde_section_lift (the (cslift s pde___ptr_to_struct_pde_C)))) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> resolve_ret_rel rv (frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) (frameBase_C_update (\<lambda>_. pde_pde_section_CL.address_CL (pde_pde_section_lift (the (cslift s pde___ptr_to_struct_pde_C)))) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t)))))))) \<and> (ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> (ret__unsigned = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse \<longrightarrow> s \<Turnstile>\<^sub>c pde___ptr_to_struct_pde_C \<and> pde_get_tag (the (cslift s pde___ptr_to_struct_pde_C)) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse \<and> (\<forall>t. ret__unsigned_' t = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C))) \<longrightarrow> (\<forall>t. ret__ptr_to_void_' t = PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C))))) \<longrightarrow> array_assertion (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C))))))) (2 ^ (ptBits - 2)) (hrs_htd (t_hrs_' (globals s))) \<and> (\<forall>t. ret__ptr_to_struct_pte_C_' t = pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr) \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr) \<and> (\<forall>t. ret__unsigned_' t = pte_get_tag (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr)))) \<longrightarrow> (pte_get_tag (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr)))) = SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr) \<and> (\<forall>t. ret__unsigned_' t = pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr))))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) \<sigma>). (\<sigma>', s\<lparr>ret__ptr_to_void_' := PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C))))), pt_' := PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))), pte___ptr_to_struct_pte_C_' := pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr), ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_small, ret__unsigned_' := pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr))))), ret___struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (frameBase_C_update (\<lambda>_. pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr)))))) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t)), ret__struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (frameBase_C_update (\<lambda>_. pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr)))))) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> resolve_ret_rel rv (frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSmallPage) (frameBase_C_update (\<lambda>_. pte_pte_small_CL.address_CL (pte_pte_small_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr)))))) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t)))))) \<and> (pte_get_tag (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr)))) \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr) \<and> pte_get_tag (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr)))) = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> (\<forall>t. ret__unsigned_' t = reserved_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr))))) \<longrightarrow> (reserved_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr))))) = SCAST(32 signed \<rightarrow> 32) 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) pte_pte_large \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<and> (SCAST(32 signed \<rightarrow> 32) pte_pte_large \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr) \<and> pte_get_tag (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr)))) = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> (\<forall>t. ret__unsigned_' t = pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr))))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) \<sigma>). (\<sigma>', s\<lparr>ret__ptr_to_void_' := PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C))))), pt_' := PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))), pte___ptr_to_struct_pte_C_' := pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr), ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_large, ret__unsigned_' := pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr))))), ret___struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr)))))) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t)), ret__struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr)))))) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> resolve_ret_rel rv (frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr)))))) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t))))))) \<and> (reserved_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr))))) \<noteq> SCAST(32 signed \<rightarrow> 32) 1 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) pte_pte_invalid \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<and> (SCAST(32 signed \<rightarrow> 32) pte_pte_invalid \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_small \<longrightarrow> (SCAST(32 signed \<rightarrow> 32) pte_pte_invalid = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<longrightarrow> s \<Turnstile>\<^sub>c pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr) \<and> pte_get_tag (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr)))) = SCAST(32 signed \<rightarrow> 32) pte_pte_large \<and> (\<forall>t. ret__unsigned_' t = pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr))))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) \<sigma>). (\<sigma>', s\<lparr>ret__ptr_to_void_' := PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C))))), pt_' := PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))), pte___ptr_to_struct_pte_C_' := pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr), ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_large, ret__unsigned_' := pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr))))), ret___struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr)))))) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t)), ret__struct_resolve_ret_C_' := frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr)))))) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t)), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> resolve_ret_rel rv (frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMLargePage) (frameBase_C_update (\<lambda>_. pte_pte_large_CL.address_CL (pte_pte_large_lift (the (cslift s (pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr)))))) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t)))))) \<and> (SCAST(32 signed \<rightarrow> 32) pte_pte_invalid \<noteq> SCAST(32 signed \<rightarrow> 32) pte_pte_large \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C))), ret__ptr_to_void_' := PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C))))), pt_' := PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))), pte___ptr_to_struct_pte_C_' := pte_Ptr (lookup_pt_slot_no_fail (ptr_val (PTR_COERCE(unit \<rightarrow> pte_C) (PTR(unit) (ptrFromPAddr (pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s pde___ptr_to_struct_pde_C)))))))) vaddr), ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) pte_pte_invalid, ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t), ret__struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> resolve_ret_rel rv (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t))))))))))))) \<and> (ret__unsigned \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_coarse \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) \<sigma>). (\<sigma>', s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t), ret__struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t), global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> resolve_ret_rel rv (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t)))))}
 2. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> page_table_at' (ptrFromPAddr x) s \<longrightarrow> ((\<lambda>a. \<forall>pte. ko_at' pte (lookup_pt_slot_no_fail (ptrFromPAddr x) vaddra) a \<longrightarrow> (page_table_at' (ptrFromPAddr x) and (\<lambda>a. True)) a) and (\<lambda>_. True)) s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> {s. \<forall>va v'. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s v)))} \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>va = x\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s) \<and> pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> va = pde_get_tag v}} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (2 subgoals):
 1. \<And>rv \<sigma> x v. \<lbrakk>pde_get_tag v \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_coarse; \<not> isPageTablePDE rv; (\<sigma>, x) \<in> rf_sr; cslift x (pde_Ptr (lookup_pd_slot pd vaddr)) = Some v; cpde_relation rv v\<rbrakk> \<Longrightarrow> (pde_get_tag v = SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> x \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pd vaddr) \<and> ((\<exists>t. ret__unsigned_' t = pde_pde_section_CL.address_CL (pde_pde_section_lift v)) \<longrightarrow> x \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pd vaddr) \<and> ((\<exists>t. ret__unsigned_' t = size_CL (pde_pde_section_lift v)) \<longrightarrow> (size_CL (pde_pde_section_lift v) \<noteq> 0 \<longrightarrow> (\<exists>xa\<in>fst ((case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> resolve_ret_rel rv (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (frameBase_C_update (\<lambda>_. pde_pde_section_CL.address_CL (pde_pde_section_lift v)) kernel_all_global_addresses.default_resolve_ret_t))))) \<and> (size_CL (pde_pde_section_lift v) = 0 \<longrightarrow> (\<exists>xa\<in>fst ((case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> resolve_ret_rel rv (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) (frameBase_C_update (\<lambda>_. pde_pde_section_CL.address_CL (pde_pde_section_lift v)) kernel_all_global_addresses.default_resolve_ret_t)))))))) \<and> (pde_get_tag v \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> (\<exists>xa\<in>fst ((case rv of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> resolve_ret_rel rv (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t)))
 2. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> page_table_at' (ptrFromPAddr x) s \<longrightarrow> ((\<lambda>a. \<forall>pte. ko_at' pte (lookup_pt_slot_no_fail (ptrFromPAddr x) vaddra) a \<longrightarrow> (page_table_at' (ptrFromPAddr x) and (\<lambda>a. True)) a) and (\<lambda>_. True)) s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> {s. \<forall>va v'. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s v)))} \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>va = x\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s) \<and> pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> va = pde_get_tag v}} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>pde_get_tag v_ \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_coarse; \<not> isPageTablePDE rv_; (\<sigma>_, x_) \<in> rf_sr; cslift x_ (pde_Ptr (lookup_pd_slot pd vaddr)) = Some v_; cpde_relation rv_ v_\<rbrakk> \<Longrightarrow> (pde_get_tag v_ = SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> x_ \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pd vaddr) \<and> ((\<exists>t. ret__unsigned_' t = pde_pde_section_CL.address_CL (pde_pde_section_lift v_)) \<longrightarrow> x_ \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pd vaddr) \<and> ((\<exists>t. ret__unsigned_' t = size_CL (pde_pde_section_lift v_)) \<longrightarrow> (size_CL (pde_pde_section_lift v_) \<noteq> 0 \<longrightarrow> (\<exists>xa\<in>fst ((case rv_ of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) \<sigma>_). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x_) \<in> rf_sr \<and> resolve_ret_rel rv (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSuperSection) (frameBase_C_update (\<lambda>_. pde_pde_section_CL.address_CL (pde_pde_section_lift v_)) kernel_all_global_addresses.default_resolve_ret_t))))) \<and> (size_CL (pde_pde_section_lift v_) = 0 \<longrightarrow> (\<exists>xa\<in>fst ((case rv_ of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) \<sigma>_). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x_) \<in> rf_sr \<and> resolve_ret_rel rv (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) (frameSize_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.ARMSection) (frameBase_C_update (\<lambda>_. pde_pde_section_CL.address_CL (pde_pde_section_lift v_)) kernel_all_global_addresses.default_resolve_ret_t)))))))) \<and> (pde_get_tag v_ \<noteq> SCAST(32 signed \<rightarrow> 32) pde_pde_section \<longrightarrow> (\<exists>xa\<in>fst ((case rv_ of ARM_H.InvalidPDE \<Rightarrow> return None | ARM_H.PageTablePDE table v61 v62 \<Rightarrow> do y <- stateAssert (page_table_at' (ptrFromPAddr table)) [];
getObject (lookup_pt_slot_no_fail (ptrFromPAddr table) vaddr) >>= ARM_H.case_pte (return None) (\<lambda>frame v42 v43 v44 v45. return (Some (Wellformed_C.ARMLargePage, frame))) (\<lambda>frame v46 v47 v48 v49. return (Some (Wellformed_C.ARMSmallPage, frame)))
od | ARM_H.SectionPDE frame v50 v51 v52 v53 v54 v55 \<Rightarrow> return (Some (Wellformed_C.ARMSection, frame)) | ARM_H.SuperSectionPDE frame v56 v57 v58 v59 v60 \<Rightarrow> return (Some (Wellformed_C.ARMSuperSection, frame))) \<sigma>_). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x_) \<in> rf_sr \<and> resolve_ret_rel rv (valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) false) kernel_all_global_addresses.default_resolve_ret_t))) proof (prove)
goal (1 subgoal):
 1. \<And>vaddra pda s s'. \<lbrakk>vaddra = vaddr; pda = pde_Ptr pd; (s, s') \<in> rf_sr; page_directory_at' pd s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>pde. ko_at' pde (lookup_pd_slot pd vaddra) s \<longrightarrow> (isPageTablePDE pde \<longrightarrow> (pde = ARM_H.InvalidPDE \<longrightarrow> True) \<and> (\<forall>x xa xb. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> page_table_at' (ptrFromPAddr x) s \<longrightarrow> ((\<lambda>a. \<forall>pte. ko_at' pte (lookup_pt_slot_no_fail (ptrFromPAddr x) vaddra) a \<longrightarrow> (page_table_at' (ptrFromPAddr x) and (\<lambda>a. True)) a) and (\<lambda>_. True)) s) \<and> (\<forall>x xa xb xc xd xe xf. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> True) \<and> (\<forall>x xa xb xc xd xe. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> True)) \<and> (\<not> isPageTablePDE pde \<longrightarrow> True)) \<and> s' \<in> {s. \<forall>pde pde'. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some pde' \<and> cpde_relation pde pde' \<longrightarrow> s \<in> {s. \<forall>v v'. v = pde_Ptr (lookupPDSlot (ptr_val (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) (vptr_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))) \<longrightarrow> s\<lparr>pde___ptr_to_struct_pde_C_' := v\<rparr> \<in> {s. s \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. s\<lparr>ret___struct_resolve_ret_C_' := valid_C_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) true) kernel_all_global_addresses.default_resolve_ret_t\<rparr> \<in> {s. \<forall>va v'. va = pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_get_tag (the (cslift s v))} \<longrightarrow> s \<in> {s. isPageTablePDE pde \<longrightarrow> s \<in> {s. pde = ARM_H.InvalidPDE \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. pde = ARM_H.PageTablePDE x xa xb \<longrightarrow> s \<in> {s. \<forall>va v'. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. s \<in> {s. va = pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift (the (cslift s v)))} \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>va = x\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s) \<and> pde_get_tag (the (cslift (pde_ptr_'_update (\<lambda>_. v) s) (pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)))) = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse}}}}} \<inter> ({s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. \<forall>xf. s \<in> {s. pde = ARM_H.SectionPDE x xa xb xc xd xe xf \<longrightarrow> s \<in> UNIV}}}}}}}} \<inter> {s. \<forall>x. s \<in> {s. \<forall>xa. s \<in> {s. \<forall>xb. s \<in> {s. \<forall>xc. s \<in> {s. \<forall>xd. s \<in> {s. \<forall>xe. s \<in> {s. pde = ARM_H.SuperSectionPDE x xa xb xc xd xe \<longrightarrow> s \<in> UNIV}}}}}}}))} \<inter> {s. \<not> isPageTablePDE pde \<longrightarrow> s \<in> {s. \<exists>v. cslift s (pde_Ptr (lookup_pd_slot pd vaddra)) = Some v \<and> cpde_relation pde v \<and> va = pde_get_tag v}} \<inter> \<lbrace>(va = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde\<rbrace>}}} \<inter> {s. pde_ptr_'_update (\<lambda>_. v) s \<Turnstile>\<^sub>c pde_ptr_' (pde_ptr_'_update (\<lambda>_. v) s)}}}}} \<inter> {s. array_assertion (pd_' (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s))) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals (vptr_'_update (\<lambda>_. vaddra) (pd_'_update (\<lambda>_. pda) s)))))}} proof (prove)
goal (1 subgoal):
 1. \<And>s s' pde pde'. \<lbrakk>(s, s') \<in> rf_sr; page_directory_at' pd s; cslift s' (pde_Ptr (lookup_pd_slot pd vaddr)) = Some pde'; cpde_relation pde pde'\<rbrakk> \<Longrightarrow> (isPageTablePDE pde \<longrightarrow> (\<forall>x. (\<exists>xa xb. pde = ARM_H.PageTablePDE x xa xb) \<longrightarrow> pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift pde') = x \<and> s' \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pd vaddr) \<and> pde_get_tag pde' = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse)) \<and> (pde_get_tag pde' = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde \<and> s' \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pd vaddr) \<and> array_assertion (pde_Ptr pd) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s'))) proof (prove)
goal (1 subgoal):
 1. \<And>s s' pde pde'. \<lbrakk>(s, s') \<in> rf_sr; page_directory_at' pd s; cslift s' (pde_Ptr (lookup_pd_slot pd vaddr)) = Some pde'; cpde_relation pde pde'; cslift s' (pd_Ptr pd) \<noteq> None\<rbrakk> \<Longrightarrow> (isPageTablePDE pde \<longrightarrow> (\<forall>x. (\<exists>xa xb. pde = ARM_H.PageTablePDE x xa xb) \<longrightarrow> pde_pde_coarse_CL.address_CL (pde_pde_coarse_lift pde') = x \<and> s' \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pd vaddr) \<and> pde_get_tag pde' = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse)) \<and> (pde_get_tag pde' = SCAST(32 signed \<rightarrow> 32) pde_pde_coarse) = isPageTablePDE pde \<and> s' \<Turnstile>\<^sub>c pde_Ptr (lookup_pd_slot pd vaddr) \<and> array_assertion (pde_Ptr pd) (2 ^ pageBits) (hrs_htd (t_hrs_' (globals s'))) proof (prove)
goal:
No subgoals!